VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98189: Linux kernel · wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in c1ba7f7f18465e259cf1b4d9c73fc73853d7f790 : patch Linux kernel soon.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in c1ba7f7f18465e259cf1b4d9c73fc73853d7f790, aeb44a456d126d89863230eef0187e77e6441995, 612ed9224eae70c53c0c88cb0990e0f9b709280a +5

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ c5c77ba18ea66aa05441c71e38473efb787705a4, < c1ba7f7f18465e259cf1b4d9c73fc73853d7f790	Fixed in c1ba7f7f18465e259cf1b4d9c73fc73853d7f790
LinuxLinux	Affected ≥ c5c77ba18ea66aa05441c71e38473efb787705a4, < aeb44a456d126d89863230eef0187e77e6441995	Fixed in aeb44a456d126d89863230eef0187e77e6441995
LinuxLinux	Affected ≥ c5c77ba18ea66aa05441c71e38473efb787705a4, < 612ed9224eae70c53c0c88cb0990e0f9b709280a	Fixed in 612ed9224eae70c53c0c88cb0990e0f9b709280a
LinuxLinux	Affected ≥ c5c77ba18ea66aa05441c71e38473efb787705a4, < 304a5d72a04a3979a6434088c8d9c5172c2a908e	Fixed in 304a5d72a04a3979a6434088c8d9c5172c2a908e
LinuxLinux	Affected ≥ c5c77ba18ea66aa05441c71e38473efb787705a4, < 14dcf4c3d74c878175b19d3da5986f83f26b1dd5	Fixed in 14dcf4c3d74c878175b19d3da5986f83f26b1dd5
LinuxLinux	Affected ≥ c5c77ba18ea66aa05441c71e38473efb787705a4, < 9f6a276ade936a8803f9f3df217c2368944dc321	Fixed in 9f6a276ade936a8803f9f3df217c2368944dc321

AI-suggested

A fix is available and has been applied in the Linux kernel. Users should update to a fixed kernel version that includes the patch identified by the listed commit hashes. The patch drops any RX transfer exceeding the buffer size, preventing the out-of-bounds write and maintaining the integrity of the RX buffer offset. No additional mitigation is required beyond applying the official fix.

Description

A vulnerability in the Linux kernel's wilc1000 WiFi driver allows an out-of-bounds write to the RX buffer due to improper size validation of device-reported RX transfer sizes. This can lead to memory corruption when a malicious SDIO device sends an oversized transfer. The issue is fixed by dropping transfers that exceed the RX buffer size, preventing overflow and maintaining driver stability.

Impact

An attacker controlling a malicious SDIO device can cause an out-of-bounds write in kernel memory by sending an oversized RX transfer, potentially leading to memory corruption. This could destabilize the kernel or allow further exploitation depending on the context. However, the fix prevents the overflow by dropping oversized transfers, maintaining system stability.

Summary

The Linux kernel's wilc1000 WiFi driver function wilc_wlan_handle_isr_ext() reads RX transfer sizes from a device interrupt status register and copies data into a fixed-size RX buffer (96K). The transfer size can be up to 131068 bytes, but the driver does not verify that this size fits within the RX buffer, allowing a malicious SDIO device to cause an out-of-bounds write by up to approximately 32K bytes. This also corrupts the buffer offset tracking, enabling repeated overflows. The fix involves dropping any transfer exceeding the RX buffer size, acknowledging the interrupt, and re-arming the RX engine to discard the bogus frame and continue normal operation. This vulnerability was discovered by Atuin - Automated Vulnerability Discovery Engine and affects Linux kernel version 4.2.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:26 UTC

Technical details

References

Community reviews

Related threats