CVE-2026-98189— wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： wifi: wilc1000: 修复 wilc_wlan_handle_isr_ext() 中 RX 缓冲区的越界写入（OOB-write）问题 函数 从设备报告的中断状态寄存器中获取 RX 传输大小（该寄存器为一个左移 2 位的 15 位字段，最大可达 131,068 字节），并将该数量的字节从设备读入 。然而， 的大小仅为 （96KB）。当前的回绕（wrap）检查仅处理当前偏移量，而从未将传输大小与缓冲区大小进行比较。因此，恶意的 SDIO 设备可构造虚假数据，导致驱动
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client ExecutionAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | c5c77ba18ea66aa05441c71e38473efb787705a4< 3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26 |
affected |
c5c77ba18ea66aa05441c71e38473efb787705a4< 9f6a276ade936a8803f9f3df217c2368944dc321 |
affected | ||
c5c77ba18ea66aa05441c71e38473efb787705a4< aeb44a456d126d89863230eef0187e77e6441995 |
affected | ||
c5c77ba18ea66aa05441c71e38473efb787705a4< 612ed9224eae70c53c0c88cb0990e0f9b709280a |
affected | ||
c5c77ba18ea66aa05441c71e38473efb787705a4< 304a5d72a04a3979a6434088c8d9c5172c2a908e |
affected | ||
c5c77ba18ea66aa05441c71e38473efb787705a4< 4f86fb6f9dce04f697da85806ad96a932fc2f079 |
affected | ||
c5c77ba18ea66aa05441c71e38473efb787705a4< 14dcf4c3d74c878175b19d3da5986f83f26b1dd5 |
affected | ||
c5c77ba18ea66aa05441c71e38473efb787705a4< c1ba7f7f18465e259cf1b4d9c73fc73853d7f790 |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-98189
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
wilc_wlan_handle_isr_ext() takes the RX transfer size from the
device-reported interrupt status register (a 15-bit field shifted left by 2,
up to 131068 bytes) and reads that many bytes from the device into
rx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap
check only handles the current offset; the size itself is never
compared against the buffer, so a bogus SDIO device can make the driver
OOB-write rx_buffer by up to ~32K with data it controls.
The oversized transfer also leaves rx_buffer_offset past the end of
the buffer, after which the unsigned wrap check stops working and
the overflow can repeat.
Drop any transfer whose size exceeds the RX buffer, acknowledging
the data interrupt and re-arming the RX engine so the bogus frame is
discarded and reception can continue. This also restores the
rx_buffer_offset <= WILC_RX_BUFF_SIZE invariant the wrap check
relies on.
This is not expected to change driver behavior in most cases:
without this check, an oversized transfer would most likely
corrupt neighboring kernel memory instead of completing anyway, and
the drop path performs the same interrupt acknowledgment and RX
engine re-arming as the normal path, so subsequent transfers are
received unaffected.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-98189
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-98189
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-98189 (8)
Same Patch Batch · Linux · 2026-10-06 · 208 CVEs total
| CVE-2026-98323 | 9.8 CRITICAL | RDMA/siw: Bound fragmented header copies by the remaining length |
| CVE-2026-98365 | 9.8 CRITICAL | RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access |
| CVE-2026-98282 | 8.8 HIGH | powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba |
| CVE-2026-98283 | 8.8 HIGH | KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() |
| CVE-2026-98339 | 8.8 HIGH | wifi: cfg80211: don't filter by BSS type when removing stale entries |
| CVE-2026-98171 | 8.8 HIGH | smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs |
| CVE-2026-98261 | 8.1 HIGH | cifs: Fix server use-after-free in cifs_chan_skip_or_disable() |
| CVE-2026-98357 | 8.1 HIGH | IB/isert: wait for deferred control PDU completions before releasing the connection |
| CVE-2026-98239 | 8.1 HIGH | net: lan743x: fix RX checksum use-after-free |
| CVE-2026-98341 | 7.8 HIGH | wifi: cfg80211: don't free driver-owned scan requests |
| CVE-2026-98324 | 7.8 HIGH | dmaengine: pxa: fix double counting of the hw descriptors |
| CVE-2026-98228 | 7.8 HIGH | mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ |
| CVE-2026-98229 | 7.8 HIGH | xfrm: save input state data before secpath resets |
| CVE-2026-98320 | 7.8 HIGH | netfilter: flowtable: hold reference on ct until flow is released |
| CVE-2026-98318 | 7.8 HIGH | smb: client: validate absolute native symlink targets before NT fixups |
| CVE-2026-98315 | 7.8 HIGH | ntfs: protect runlist updates with the runlist lock |
| CVE-2026-98260 | 7.8 HIGH | exec: Cleanup POSIX timers right after de_thread() |
| CVE-2026-98256 | 7.8 HIGH | signal: Prevent exec() race |
| CVE-2026-98258 | 7.8 HIGH | posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list |
| CVE-2026-98254 | 7.8 HIGH | swiotlb: use the adjusted address for the highmem page lookup |
Showing top 20 of 208 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2026-98189
No comments yet