Cloudanix VulnDB

CVE-2026-98189

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux Wi-Fi drivers lets a faulty wireless chip send too much data and overwrite parts of the computer's memory, which could crash the system or allow an attacker to take control.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Unbounded device-reported RX transfer size allows OOB write of up to ~32 KB into a 96 KB kernel buffer and corrupts the buffer offset, defeating subsequent wrap checks.

Why it matters to the business

Systems using the wilc1000 Wi-Fi driver face risk of kernel memory corruption that can cause crashes, instability, or potential privilege escalation until patched.

How an attack unfolds

An attacker with a malicious or compromised SDIO device supplies an oversized RX transfer length via the interrupt status register; the driver copies the data past the end of rx_buffer and advances the offset beyond the buffer, enabling repeated overflows or memory corruption.

How to fix it

Update to a Linux kernel containing the fix that drops any RX transfer whose size exceeds the buffer and restores the offset invariant; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the presence of the size check against WILC_RX_BUFF_SIZE inside wilc_wlan_handle_isr_ext() in the running kernel source or binary; test that oversized transfers are silently dropped without corrupting memory.

Typical attack path

  1. Gain control of or emulate an SDIO device visible to the wilc1000 driver
  2. Trigger an interrupt with a 15-bit size field that encodes a transfer larger than WILC_RX_BUFF_SIZE
  3. Driver performs unchecked read into rx_buffer, writing beyond its bounds
  4. rx_buffer_offset is left past the buffer end, disabling future wrap detection
  5. Attacker-controlled data corrupts adjacent kernel memory, potentially leading to further exploitation

How to detect it

Review kernel logs for wilc1000 driver crashes, unexpected memory corruption symptoms, or oops reports around wilc_wlan_handle_isr_ext; correlate with SDIO device events; no public exploit artifacts are known.

What your security team should do

  • Prioritize kernel updates on all systems exposing the wilc1000 driver
  • Monitor vendor advisories for backported fixes in supported distributions
  • Consider disabling the wilc1000 driver if the hardware is not required
  • Reboot systems after applying the update to load the corrected driver

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() wilc_wlan_handle_isr_ext() takes the RX transfer size from the device-reported interrupt status register (a 15-bit field shifted left by 2, up to 131068 bytes) and reads that many bytes from the device into rx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap check only handles the current offset; the size itself is never compared against the buffer, so a bogus SDIO device can make the driver OOB-write rx_buffer by up to ~32K with data it controls. The oversized transfer also leaves rx_buffer_offset past the end of the buffer, after which the unsigned wrap check stops working and the overflow can repeat. Drop any transfer whose size exceeds the RX buffer, acknowledging the data interrupt and re-arming the RX engine so the bogus frame is discarded and reception can continue. This also restores the rx_buffer_offset <= WILC_RX_BUFF_SIZE invariant the wrap check relies on. This is not expected to change driver behavior in most cases: without this check, an oversized transfer would most likely corrupt neighboring kernel memory instead of completing anyway, and the drop path performs the same interrupt acknowledgment and RX engine re-arming as the normal path, so subsequent transfers are received unaffected. Discovered by Atuin - Automated Vulnerability Discovery Engine.

Affected packages

Ecosystem Package Introduced Fixed