VulnerabilityPublished 14 Oct 2026Updated 19 Oct 2026

CVE-2026-98407: Linux kernel · wifi: rsi: fix heap OOB write on key removal

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f4f2852b664c3ff1436785cd11258a0ce25b74b3 : patch Linux kernel soon.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f4f2852b664c3ff1436785cd11258a0ce25b74b3, e6c5ed7a98d7bc8b0f7918246f1c90ddb3f79dfa, c67fb3b875a83f9ba92afea4036c7b541f77512a +5

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ dad0d04fa7ba41ce603a01e8e64967650303e9a2, < f4f2852b664c3ff1436785cd11258a0ce25b74b3	Fixed in f4f2852b664c3ff1436785cd11258a0ce25b74b3
LinuxLinux	Affected ≥ dad0d04fa7ba41ce603a01e8e64967650303e9a2, < e6c5ed7a98d7bc8b0f7918246f1c90ddb3f79dfa	Fixed in e6c5ed7a98d7bc8b0f7918246f1c90ddb3f79dfa
LinuxLinux	Affected ≥ dad0d04fa7ba41ce603a01e8e64967650303e9a2, < c67fb3b875a83f9ba92afea4036c7b541f77512a	Fixed in c67fb3b875a83f9ba92afea4036c7b541f77512a
LinuxLinux	Affected ≥ dad0d04fa7ba41ce603a01e8e64967650303e9a2, < b79e2f6585c014c42384f4caa7a37b3e5d26179c	Fixed in b79e2f6585c014c42384f4caa7a37b3e5d26179c
LinuxLinux	Affected ≥ dad0d04fa7ba41ce603a01e8e64967650303e9a2, < ac599cf8edf8aa2dae546f04d3f1849e32c2e738	Fixed in ac599cf8edf8aa2dae546f04d3f1849e32c2e738
LinuxLinux	Affected ≥ dad0d04fa7ba41ce603a01e8e64967650303e9a2, < 62d40db89180cfab7a917395f9ffc1dac62b0019	Fixed in 62d40db89180cfab7a917395f9ffc1dac62b0019

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix is available and has been applied in multiple Linux kernel commits. Users and administrators should update to a Linux kernel version that includes these fixes to eliminate the vulnerability. No additional mitigations are indicated as the patch removes the redundant and unsafe memset operation.

Description

CVE-2026-98407 is a heap out-of-bounds write vulnerability in the Linux kernel's wifi rsi driver triggered during key removal. The flaw occurs because a memset operation writes beyond the allocated buffer, corrupting unrelated heap memory. This happens on every key disable event, such as disconnects, roams, and interface teardowns. The vulnerability was discovered by an automated vulnerability discovery engine and has been fixed by removing the redundant memset call.

Impact

Heap corruption caused by out-of-bounds writes can lead to memory corruption, potentially destabilizing the kernel or enabling privilege escalation or denial of service. Since the write occurs on common network events (key removal), the vulnerability is likely to be triggered frequently in affected systems. However, no known exploits in the wild have been reported.

Summary

The vulnerability in the Linux kernel wifi rsi driver involves an out-of-bounds heap write triggered when a key is removed (data == NULL). The function rsi_hal_load_key() incorrectly calculates the offset for memset, causing it to write 144 zero bytes starting 2.4KB past the end of a 160-byte buffer. This corrupts unrelated heap objects. The memset is redundant because the buffer is zeroed after allocation, so the fix removes this else branch. The flaw is triggered on every DISABLE_KEY callback, affecting normal network operations like disconnects and roams. Multiple commits have fixed this issue in the Linux kernel source.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:33 UTC

Technical details

References

Community reviews

Related threats