CVE-2026-98189

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()

wilc_wlan_handle_isr_ext() takes the RX transfer size from the

device-reported interrupt status register (a 15-bit field shifted left by 2,

up to 131068 bytes) and reads that many bytes from the device into

rx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap

check only handles the current offset; the size itself is never

compared against the buffer, so a bogus SDIO device can make the driver

OOB-write rx_buffer by up to ~32K with data it controls.

The oversized transfer also leaves rx_buffer_offset past the end of

the buffer, after which the unsigned wrap check stops working and

the overflow can repeat.

Drop any transfer whose size exceeds the RX buffer, acknowledging

the data interrupt and re-arming the RX engine so the bogus frame is

discarded and reception can continue. This also restores the

rx_buffer_offset <= WILC_RX_BUFF_SIZE

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References