CVE-2026-98190 - Vulnerability Details

- wifi: wilc1000: fix out-of-bounds read in P2P public action frames

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix out-of-bounds read in P2P public action frames

wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once
ieee80211_is_public_action() returns true. That helper only verifies the
frame is long enough for the action category field, that is
offsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both
functions then read the P2P public action header up to oui_subtype at
offset 30 and pass "size - ie_offset" to cfg80211_find_vendor_ie(), where
ie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32.

A public action frame of 25 to 31 bytes passes the check but is shorter
than that 32 byte header, so oui_subtype can be read out of bounds, and
because the length is unsigned, "size - ie_offset" underflows to a value
close to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length,
so even the size_t subtraction in mgmt_tx() is truncated to the same
value. It then walks far past the buffer searching for a vendor element
until it reaches unmapped memory.

In the receive path the frame arrives over the air and needs no
association, so a nearby unauthenticated device can crash the host while
it is in P2P listen. Reject frames shorter than the P2P public action
header in both paths before dereferencing it.

Published: 2026-10-06

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerable code exists in the Linux wilc1000 Wi‑Fi driver. When the driver parses a P2P public action frame that is only 25 to 31 bytes long, it fails to verify the frame meets the 32‑byte header length. The code then reads the oui_subtype field out of bounds, and a size underflow causes an over‑sized search buffer that walks into unmapped memory. This results in a kernel panic and a system reboot or loss of service. The weakness is a classic buffer read overflow that can crash the host.

Affected Systems

All Linux kernels that include the wilc1000 driver before the patch commit. The fix addresses the driver in the mainline kernel; any distribution using a pre‑patched kernel is affected. No specific LTS version is singled out, so all up‑to‑date kernels after the patch are safe.

Risk and Exploitability

Based on the description, it is inferred that a nearby unauthenticated wireless device can send a crafted 25‑31 byte P2P action frame to a host in P2P listen mode, which would trigger the crash. The likely attack vector is a local wireless proximity attack requiring no authentication, making it low effort but potentially high impact. The EPSS score is less than 1% and the vulnerability is not listed in KEV. The attack scenario is straightforward and the consequences are significant for an affected device. The CVSS score is 5.5.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4fb8b5aa2a1126783ae00bae544d6f3c519408ef`	affected	< e98ad9f4c59f2e836f8d971b57763a4277680422
`4fb8b5aa2a1126783ae00bae544d6f3c519408ef`	affected	< f0c46f8111a479b97b8ab17747c528cade6257f1
`4fb8b5aa2a1126783ae00bae544d6f3c519408ef`	affected	< a5b827dad8a3037cef04d0240d1c2acb1557101e
`4fb8b5aa2a1126783ae00bae544d6f3c519408ef`	affected	< 491df93b10d76aebaf6aa4bb05a6ba897f4fccfb
`4fb8b5aa2a1126783ae00bae544d6f3c519408ef`	affected	< cc2ee642ebeac8699b671ddb6d5955a785e5ff43
`4fb8b5aa2a1126783ae00bae544d6f3c519408ef`	affected	< 68b786691ce24c5c94e28811db243e573c50f9c1
`4fb8b5aa2a1126783ae00bae544d6f3c519408ef`	affected	< 6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304
`4fb8b5aa2a1126783ae00bae544d6f3c519408ef`	affected	< ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4fb8b5aa2a1126783ae00bae544d6f3c519408ef,e98ad9f4c59f2e836f8d971b57763a4277680422)`	affected	code_commit	—
`[4fb8b5aa2a1126783ae00bae544d6f3c519408ef,f0c46f8111a479b97b8ab17747c528cade6257f1)`	affected	code_commit	—
`[4fb8b5aa2a1126783ae00bae544d6f3c519408ef,a5b827dad8a3037cef04d0240d1c2acb1557101e)`	affected	code_commit	—
`[4fb8b5aa2a1126783ae00bae544d6f3c519408ef,491df93b10d76aebaf6aa4bb05a6ba897f4fccfb)`	affected	code_commit	—
`[4fb8b5aa2a1126783ae00bae544d6f3c519408ef,cc2ee642ebeac8699b671ddb6d5955a785e5ff43)`	affected	code_commit	—
`[4fb8b5aa2a1126783ae00bae544d6f3c519408ef,68b786691ce24c5c94e28811db243e573c50f9c1)`	affected	code_commit	—
`[4fb8b5aa2a1126783ae00bae544d6f3c519408ef,6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304)`	affected	code_commit	—
`[4fb8b5aa2a1126783ae00bae544d6f3c519408ef,ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[5.10.271,5.10.*]`	unaffected	generic	—
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.112,6.12.*]`	unaffected	generic	—
`[6.18.54,6.18.*]`	unaffected	generic	—
`[7.2.8,7.2.*]`	unaffected	generic	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to a Linux kernel version that includes the wilc1000 patch (commit 491df93b10d76aebaf6aa4bb05a6ba897f4fccfb).
Rebuild embedded firmware or custom kernel images to incorporate the patched wilc1000 driver when a direct kernel upgrade is not feasible.
If an immediate kernel upgrade is impossible, disable the wilc1000 wireless interface or turn off P2P mode to prevent receipt of malicious frames while a patch is applied.

Generated by OpenCVE AI on October 9, 2026 at 03:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98190.mbox
https://git.kernel.org/stable/c/491df93b10d76aebaf6aa4bb05a6ba897f4fccfb
https://git.kernel.org/stable/c/68b786691ce24c5c94e28811db243e573c50f9c1
https://git.kernel.org/stable/c/6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304
https://git.kernel.org/stable/c/a5b827dad8a3037cef04d0240d1c2acb1557101e
https://git.kernel.org/stable/c/ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14
https://git.kernel.org/stable/c/cc2ee642ebeac8699b671ddb6d5955a785e5ff43
https://git.kernel.org/stable/c/e98ad9f4c59f2e836f8d971b57763a4277680422
https://git.kernel.org/stable/c/f0c46f8111a479b97b8ab17747c528cade6257f1
https://nvd.nist.gov/vuln/detail/CVE-2026-98190
https://www.cve.org/CVERecord?id=CVE-2026-98190

History

Fri, 09 Oct 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98190.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98190 https://www.cve.org/CVERecord?id=CVE-2026-98190
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 07 Oct 2026 07:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Wed, 07 Oct 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Tue, 06 Oct 2026 11:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once ieee80211_is_public_action() returns true. That helper only verifies the frame is long enough for the action category field, that is offsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both functions then read the P2P public action header up to oui_subtype at offset 30 and pass "size - ie_offset" to cfg80211_find_vendor_ie(), where ie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32. A public action frame of 25 to 31 bytes passes the check but is shorter than that 32 byte header, so oui_subtype can be read out of bounds, and because the length is unsigned, "size - ie_offset" underflows to a value close to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length, so even the size_t subtraction in mgmt_tx() is truncated to the same value. It then walks far past the buffer searching for a vendor element until it reaches unmapped memory. In the receive path the frame arrives over the air and needs no association, so a nearby unauthenticated device can crash the host while it is in P2P listen. Reject frames shorter than the P2P public action header in both paths before dereferencing it.
Title		wifi: wilc1000: fix out-of-bounds read in P2P public action frames
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/491df93b10d76aebaf6aa4bb05a6ba897f4fccfb https://git.kernel.org/stable/c/68b786691ce24c5c94e28811db243e573c50f9c1 https://git.kernel.org/stable/c/6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304 https://git.kernel.org/stable/c/a5b827dad8a3037cef04d0240d1c2acb1557101e https://git.kernel.org/stable/c/ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14 https://git.kernel.org/stable/c/cc2ee642ebeac8699b671ddb6d5955a785e5ff43 https://git.kernel.org/stable/c/e98ad9f4c59f2e836f8d971b57763a4277680422 https://git.kernel.org/stable/c/f0c46f8111a479b97b8ab17747c528cade6257f1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:44:31.520Z

Updated: 2026-10-19T09:15:21.647Z

Reserved: 2026-09-25T10:25:14.323Z

Link: CVE-2026-98190

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:04.210

Modified: 2026-10-19T10:18:19.400

Link: CVE-2026-98190

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98190 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-09T04:00:17Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object