Cloudanix VulnDB

CVE-2026-98190

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain Linux Wi-Fi chips lets nearby devices send a specially crafted wireless signal that can crash the computer without any login or connection.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read when parsing short IEEE 802.11 public action frames in wilc_wfi_p2p_rx() and mgmt_tx(); an unsigned length underflow allows cfg80211_find_vendor_ie() to walk far beyond the supplied buffer, leading to a kernel crash.

Why it matters to the business

Nearby unauthenticated attackers can remotely crash Wi-Fi hosts using the wilc1000 driver, causing denial of service and potential loss of wireless connectivity on affected Linux systems.

How an attack unfolds

An attacker crafts a 25-31 byte IEEE 802.11 public action frame containing a P2P OUI and transmits it in the clear while the target is in P2P listen mode; the frame passes the initial category check but triggers the out-of-bounds read and length underflow inside the wilc1000 receive path.

How to fix it

Apply the upstream kernel patch that adds an explicit length check for the full P2P public action header before parsing in both wilc_wfi_p2p_rx() and mgmt_tx(); rebuild and deploy the updated kernel on all systems using the wilc1000 driver.

How to confirm the fix worked

Confirm the presence of the length check before the oui_subtype dereference in wilc_wfi_p2p_rx() and mgmt_tx(); verify that frames shorter than 32 bytes are rejected; test with crafted short P2P frames to ensure no crash occurs.

Typical attack path

  1. Position within wireless range of target in P2P listen state
  2. Transmit a short public action frame (25-31 bytes) with P2P OUI
  3. wilc_wfi_p2p_rx() accepts the frame and dereferences beyond the buffer
  4. cfg80211_find_vendor_ie() walks unmapped memory causing kernel panic

How to detect it

Inspect kernel logs for wilc1000 or cfg80211 oops/panic entries triggered by management frame processing; correlate with wireless interface activity and short public action frames observed on the air.

What your security team should do

  • Prioritize kernel updates for all devices using the wilc1000 wireless driver
  • Monitor for wireless-related kernel oops or panics on affected hosts
  • Disable P2P mode where operationally feasible until patches are applied
  • Review downstream device images that embed wilc1000 firmware and driver

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once ieee80211_is_public_action() returns true. That helper only verifies the frame is long enough for the action category field, that is offsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both functions then read the P2P public action header up to oui_subtype at offset 30 and pass "size - ie_offset" to cfg80211_find_vendor_ie(), where ie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32. A public action frame of 25 to 31 bytes passes the check but is shorter than that 32 byte header, so oui_subtype can be read out of bounds, and because the length is unsigned, "size - ie_offset" underflows to a value close to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length, so even the size_t subtraction in mgmt_tx() is truncated to the same value. It then walks far past the buffer searching for a vendor element until it reaches unmapped memory. In the receive path the frame arrives over the air and needs no association, so a nearby unauthenticated device can crash the host while it is in P2P listen. Reject frames shorter than the P2P public action header in both paths before dereferencing it.

Affected packages

Ecosystem Package Introduced Fixed