CVE-2026-98189

wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()

Published Oct 6, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()

wilc_wlan_handle_isr_ext() takes the RX transfer size from the
device-reported interrupt status register (a 15-bit field shifted left by 2,
up to 131068 bytes) and reads that many bytes from the device into
rx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap
check only handles the current offset; the size itself is never
compared against the buffer, so a bogus SDIO device can make the driver
OOB-write rx_buffer by up to ~32K with data it controls.

The oversized transfer also leaves rx_buffer_offset past the end of
the buffer, after which the unsigned wrap check stops working and
the overflow can repeat.

Drop any transfer whose size exceeds the RX buffer, acknowledging
the data interrupt and re-arming the RX engine so the bogus frame is
discarded and reception can continue. This also restores the
rx_buffer_offset <= WILC_RX_BUFF_SIZE invariant the wrap check
relies on.

This is not expected to change driver behavior in most cases:
without this check, an oversized transfer would most likely
corrupt neighboring kernel memory instead of completing anyway, and
the drop path performs the same interrupt acknowledgment and RX
engine re-arming as the normal path, so subsequent transfers are
received unaffected.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c5c77ba18ea66aa05441c71e38473efb787705a4`	affected	< 3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26
`c5c77ba18ea66aa05441c71e38473efb787705a4`	affected	< 9f6a276ade936a8803f9f3df217c2368944dc321
`c5c77ba18ea66aa05441c71e38473efb787705a4`	affected	< aeb44a456d126d89863230eef0187e77e6441995
`c5c77ba18ea66aa05441c71e38473efb787705a4`	affected	< 612ed9224eae70c53c0c88cb0990e0f9b709280a
`c5c77ba18ea66aa05441c71e38473efb787705a4`	affected	< 304a5d72a04a3979a6434088c8d9c5172c2a908e
`c5c77ba18ea66aa05441c71e38473efb787705a4`	affected	< 4f86fb6f9dce04f697da85806ad96a932fc2f079
`c5c77ba18ea66aa05441c71e38473efb787705a4`	affected	< 14dcf4c3d74c878175b19d3da5986f83f26b1dd5
`c5c77ba18ea66aa05441c71e38473efb787705a4`	affected	< c1ba7f7f18465e259cf1b4d9c73fc73853d7f790

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[c5c77ba18ea66aa05441c71e38473efb787705a4,3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26)`	affected	code_commit	—
`[c5c77ba18ea66aa05441c71e38473efb787705a4,9f6a276ade936a8803f9f3df217c2368944dc321)`	affected	code_commit	—
`[c5c77ba18ea66aa05441c71e38473efb787705a4,aeb44a456d126d89863230eef0187e77e6441995)`	affected	code_commit	—
`[c5c77ba18ea66aa05441c71e38473efb787705a4,612ed9224eae70c53c0c88cb0990e0f9b709280a)`	affected	code_commit	—
`[c5c77ba18ea66aa05441c71e38473efb787705a4,304a5d72a04a3979a6434088c8d9c5172c2a908e)`	affected	code_commit	—
`[c5c77ba18ea66aa05441c71e38473efb787705a4,4f86fb6f9dce04f697da85806ad96a932fc2f079)`	affected	code_commit	—
`[c5c77ba18ea66aa05441c71e38473efb787705a4,14dcf4c3d74c878175b19d3da5986f83f26b1dd5)`	affected	code_commit	—
`[c5c77ba18ea66aa05441c71e38473efb787705a4,c1ba7f7f18465e259cf1b4d9c73fc73853d7f790)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[4.2,4.2]`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[5.10.271,6.0.0)`	unaffected	semver	—
`[5.15.222,6.0.0)`	unaffected	semver	—
`[6.1.189,7.0.0)`	unaffected	semver	—
`[6.6.158,7.0.0)`	unaffected	semver	—
`[6.12.112,7.0.0)`	unaffected	semver	—
`[6.18.54,7.0.0)`	unaffected	semver	—
`[7.2.8,8.0.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.177% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98189.mbox
https://git.kernel.org/stable/c/14dcf4c3d74c878175b19d3da5986f83f26b1dd5
https://git.kernel.org/stable/c/304a5d72a04a3979a6434088c8d9c5172c2a908e
https://git.kernel.org/stable/c/3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26
https://git.kernel.org/stable/c/4f86fb6f9dce04f697da85806ad96a932fc2f079
https://git.kernel.org/stable/c/612ed9224eae70c53c0c88cb0990e0f9b709280a
https://git.kernel.org/stable/c/9f6a276ade936a8803f9f3df217c2368944dc321
https://git.kernel.org/stable/c/aeb44a456d126d89863230eef0187e77e6441995
https://git.kernel.org/stable/c/c1ba7f7f18465e259cf1b4d9c73fc73853d7f790
https://nvd.nist.gov/vuln/detail/CVE-2026-98189
https://www.cve.org/CVERecord?id=CVE-2026-98189

History

Oct 9, 2026 4:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-119

Oct 9, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98189.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98189 https://www.cve.org/CVERecord?id=CVE-2026-98189
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Oct 6, 2026 12:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119

Oct 6, 2026 9:00 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() wilc_wlan_handle_isr_ext() takes the RX transfer size from the device-reported interrupt status register (a 15-bit field shifted left by 2, up to 131068 bytes) and reads that many bytes from the device into rx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap check only handles the current offset; the size itself is never compared against the buffer, so a bogus SDIO device can make the driver OOB-write rx_buffer by up to ~32K with data it controls. The oversized transfer also leaves rx_buffer_offset past the end of the buffer, after which the unsigned wrap check stops working and the overflow can repeat. Drop any transfer whose size exceeds the RX buffer, acknowledging the data interrupt and re-arming the RX engine so the bogus frame is discarded and reception can continue. This also restores the rx_buffer_offset <= WILC_RX_BUFF_SIZE invariant the wrap check relies on. This is not expected to change driver behavior in most cases: without this check, an oversized transfer would most likely corrupt neighboring kernel memory instead of completing anyway, and the drop path performs the same interrupt acknowledgment and RX engine re-arming as the normal path, so subsequent transfers are received unaffected. Discovered by Atuin - Automated Vulnerability Discovery Engine.
Title		wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/14dcf4c3d74c878175b19d3da5986f83f26b1dd5 https://git.kernel.org/stable/c/304a5d72a04a3979a6434088c8d9c5172c2a908e https://git.kernel.org/stable/c/3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26 https://git.kernel.org/stable/c/4f86fb6f9dce04f697da85806ad96a932fc2f079 https://git.kernel.org/stable/c/612ed9224eae70c53c0c88cb0990e0f9b709280a https://git.kernel.org/stable/c/9f6a276ade936a8803f9f3df217c2368944dc321 https://git.kernel.org/stable/c/aeb44a456d126d89863230eef0187e77e6441995 https://git.kernel.org/stable/c/c1ba7f7f18465e259cf1b4d9c73fc73853d7f790