CVE-2026-98407— wifi: rsi: fix heap OOB write on key removal
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed (data == NULL), rsi_hal_load_key() runs: memset(&set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ); set_key is a struct r
影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | dad0d04fa7ba41ce603a01e8e64967650303e9a2< b79e2f6585c014c42384f4caa7a37b3e5d26179c |
affected |
dad0d04fa7ba41ce603a01e8e64967650303e9a2< c67fb3b875a83f9ba92afea4036c7b541f77512a |
affected | ||
dad0d04fa7ba41ce603a01e8e64967650303e9a2< 62d40db89180cfab7a917395f9ffc1dac62b0019 |
affected | ||
dad0d04fa7ba41ce603a01e8e64967650303e9a2< 00bea3589255603c38766cac4a4d6d36493b2556 |
affected | ||
dad0d04fa7ba41ce603a01e8e64967650303e9a2< ac599cf8edf8aa2dae546f04d3f1849e32c2e738 |
affected | ||
dad0d04fa7ba41ce603a01e8e64967650303e9a2< f4f2852b664c3ff1436785cd11258a0ce25b74b3 |
affected | ||
dad0d04fa7ba41ce603a01e8e64967650303e9a2< 8dab6ee020b2cd951b670626ba44a95cd4deac3d |
affected | ||
dad0d04fa7ba41ce603a01e8e64967650303e9a2< e6c5ed7a98d7bc8b0f7918246f1c90ddb3f79dfa |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-98407 基础信息
漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
wifi: rsi: fix heap OOB write on key removal
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi: fix heap OOB write on key removal
When a key is removed (data == NULL), rsi_hal_load_key() runs:
memset(&set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ);
set_key is a struct rsi_set_key *, so the subscript is scaled by
sizeof(struct rsi_set_key) (160 bytes): &set_key[FRAME_DESC_SZ] is
skb->data + 2560, and the memset writes 144 zero bytes starting
2.4KB past the end of the 160-byte skb data buffer, corrupting
unrelated heap objects. The intended byte offset would have been
(u8 *)set_key + FRAME_DESC_SZ.
The write fires on every DISABLE_KEY callback, so plain disconnects,
roams and interface teardowns trigger it on real networks.
The memset is redundant: the whole buffer is zeroed right after
allocation, so the frame sent to the device is byte-identical
without it. Drop the else branch; normal operation is unaffected.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-98407 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-98407 的情报信息
请登录查看更多情报信息。
CVE-2026-98407 其他参考 (8)
同批安全公告 · Linux · 2026-10-14 · 共 46 条
| CVE-2026-98398 | locking/lockdep: Invalidate stale class_cache entries for zapped classes | |
| CVE-2026-98396 | powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() | |
| CVE-2026-98393 | net: ipv4: Fix UDP length overflow with PMTU discover and big MTU | |
| CVE-2026-98391 | drm/xe: Guard page-fault worker with runtime PM check | |
| CVE-2026-98389 | drm/amdgpu: skip gfx switch_power_profile during GPU reset | |
| CVE-2026-98388 | exec: do_close_on_exec() before taking exec_update_lock | |
| CVE-2026-98387 | s390/crypto: Fix skcipher_walk return code handling in aes_s390 | |
| CVE-2026-98386 | scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot | |
| CVE-2026-98390 | x86/amd_node: Avoid divide by zero on virtualized systems | |
| CVE-2026-98397 | platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown | |
| CVE-2026-98395 | powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit | |
| CVE-2026-98399 | s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block | |
| CVE-2026-98400 | s390/ipl: Fix NULL deref in kdump without re-IPL parm block | |
| CVE-2026-98402 | net: icmp: avoid invalid transport header access in icmp_send tracepoint | |
| CVE-2026-98401 | net: iptunnel: fix stale transport header during tunnel decapsulation | |
| CVE-2026-98403 | s390/boot: Avoid IPL parameter append past command line | |
| CVE-2026-98404 | drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() | |
| CVE-2026-98405 | smb: client: fix missing iov bounds check in parse_posix_sids() | |
| CVE-2026-98406 | wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver | |
| CVE-2026-98408 | watchdog: rzv2h: Avoid division by zero |
显示前 20 条，共 46 条。 查看全部 → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99999
ipv4: validate checksum_start before completing checksum -
CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period -
CVE-2026-98431
RDMA/uverbs: Fix mmap_lock/disassociation_lock circular depe -
CVE-2026-98430
RDMA/efa: Keep admin queues alive while IRQ is registered -
CVE-2026-98429
RDMA/efa: Keep EQ resources alive while IRQ is registered
Same vendor: Linux
-
CVE-2026-99999
ipv4: validate checksum_start before completing checksum -
CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period -
CVE-2026-98431
RDMA/uverbs: Fix mmap_lock/disassociation_lock circular depe -
CVE-2026-98430
RDMA/efa: Keep admin queues alive while IRQ is registered -
CVE-2026-98429
RDMA/efa: Keep EQ resources alive while IRQ is registered
V. Comments for CVE-2026-98407
暂无评论