CVE-2026-98190

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix out-of-bounds read in P2P public action frames

wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once

ieee80211_is_public_action() returns true. That helper only verifies the

frame is long enough for the action category field, that is

offsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both

functions then read the P2P public action header up to oui_subtype at

offset 30 and pass "size - ie_offset" to cfg80211_find_vendor_ie(), where

ie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32.

A public action frame of 25 to 31 bytes passes the check but is shorter

than that 32 byte header, so oui_subtype can be read out of bounds, and

because the length is unsigned, "size - ie_offset" underflows to a value

close to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length,

so even the size_t subtraction in mgmt_tx() is truncated to the same

value. It then walks far pa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References