CVE-2026-98889

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwl mvm scan fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl mvm build scan probe() after the fits check.

Also advertise max sched scan ie len using iwl mvm max scan ie len() so userspace limits account for driver-inserted DS/TPC bytes.