CVE-2026-98190: Linux kernel · wifi: wilc1000: fix out-of-bounds read in P2P public action frames
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f0c46f8111a479b97b8ab17747c528cade6257f1 : patch Linux kernel soon.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f0c46f8111a479b97b8ab17747c528cade6257f1, e98ad9f4c59f2e836f8d971b57763a4277680422, cc2ee642ebeac8699b671ddb6d5955a785e5ff43 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix for this vulnerability is available in Linux kernel versions after 5.7, as indicated by multiple fixed commits. Users should upgrade to a patched kernel version that includes these fixes. No additional mitigation is required once the system is updated.
Description
A vulnerability in the Linux kernel's wilc1000 WiFi driver allows an out-of-bounds read in P2P public action frames. The flaw occurs because the code improperly parses frames that are shorter than the expected 32-byte P2P public action header, leading to an out-of-bounds read and potential crash. This can be triggered by unauthenticated nearby devices sending crafted frames while the host is in P2P listen mode. The issue affects Linux kernel version 5.7 and has been fixed in subsequent commits.
References
- git.kernel.org/stable/c/e98ad9f4c59f2e836f8d971b57763a4277680422 (opens in a new tab)
- git.kernel.org/stable/c/f0c46f8111a479b97b8ab17747c528cade6257f1 (opens in a new tab)
- git.kernel.org/stable/c/a5b827dad8a3037cef04d0240d1c2acb1557101e (opens in a new tab)
- git.kernel.org/stable/c/491df93b10d76aebaf6aa4bb05a6ba897f4fccfb (opens in a new tab)
- git.kernel.org/stable/c/cc2ee642ebeac8699b671ddb6d5955a785e5ff43 (opens in a new tab)
- git.kernel.org/stable/c/68b786691ce24c5c94e28811db243e573c50f9c1 (opens in a new tab)
- git.kernel.org/stable/c/6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304 (opens in a new tab)
- git.kernel.org/stable/c/ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14 (opens in a new tab)