Cloudanix VulnDB

CVE-2026-98407

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux Wi-Fi hardware drivers can corrupt memory during normal network disconnects, potentially crashing systems or allowing attacks.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Heap out-of-bounds write in rsi_hal_load_key() due to scaled pointer arithmetic on a struct rsi_set_key pointer instead of byte offset, causing memset to corrupt unrelated heap objects on DISABLE_KEY operations.

Why it matters to the business

Linux systems using affected rsi wireless hardware risk kernel instability, crashes, or potential code execution during routine Wi-Fi disconnects, roaming, or interface changes, with moderate urgency given recent publication but low observed exploitation.

How an attack unfolds

An attacker on the same network initiates a disconnect, roam, or teardown that triggers a key removal callback; the flawed memset then writes beyond the allocated skb buffer, corrupting heap memory that may be leveraged for further attacks.

How to fix it

Apply the upstream kernel patch that removes the redundant memset in the else branch of rsi_hal_load_key(); rebuild and deploy the fixed kernel to all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting rsi_hal_load_key() source for absence of the scaled memset on data==NULL; test by performing disconnect/roam operations and verifying no heap corruption in kernel logs.

Typical attack path

  1. Associate with target using rsi wifi driver
  2. Trigger key removal via disconnect, roam, or teardown
  3. OOB memset corrupts adjacent heap objects
  4. Leverage corruption for denial of service or code execution

How to detect it

Review kernel logs for oops, slab corruption warnings, or RSI driver messages around Wi-Fi disconnect/roam events; correlate with network activity logs showing key removal callbacks.

What your security team should do

  • Prioritize patching kernel on systems with rsi wireless drivers
  • Monitor for kernel oops or memory corruption indicators during Wi-Fi events
  • Limit exposure by disabling unnecessary wireless interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed (data == NULL), rsi_hal_load_key() runs: memset(&set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ); set_key is a struct rsi_set_key *, so the subscript is scaled by sizeof(struct rsi_set_key) (160 bytes): &set_key[FRAME_DESC_SZ] is skb->data + 2560, and the memset writes 144 zero bytes starting 2.4KB past the end of the 160-byte skb data buffer, corrupting unrelated heap objects. The intended byte offset would have been (u8 *)set_key + FRAME_DESC_SZ. The write fires on every DISABLE_KEY callback, so plain disconnects, roams and interface teardowns trigger it on real networks. The memset is redundant: the whole buffer is zeroed right after allocation, so the frame sent to the device is byte-identical without it. Drop the else branch; normal operation is unaffected. Discovered by Atuin - Automated Vulnerability Discovery Engine.

Affected packages

Ecosystem Package Introduced Fixed