wifi: wilc1000: fix out-of-bounds read in P2P public action frames
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once ieee80211_is_public_action() returns true. That helper only verifies the frame is long enough for the action category field, that is offsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both functions then read the P2P public action header up to oui_subtype at offset 30 and pass "size - ie_offset" to cfg80211_find_vendor_ie(), where ie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32. A public action frame of 25 to 31 bytes passes the check but is shorter than that 32 byte header, so oui_subtype can be read out of bounds, and because the length is unsigned, "size - ie_offset" underflows to a value close to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length, so even the size_t subtraction in mgmt_tx() is truncated to the same value. It then walks far past the buffer searching for a vendor element until it reaches unmapped memory. In the receive path the frame arrives over the air and needs no association, so a nearby unauthenticated device can crash the host while it is in P2P listen. Reject frames shorter than the P2P public action header in both paths before dereferencing it.
CVE-2026-98190
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98190
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"lessThan": "e98ad9f4c59f2e836f8d971b57763a4277680422",
"versionType": "git"
},
{
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"lessThan": "f0c46f8111a479b97b8ab17747c528cade6257f1",
"versionType": "git"
},
{
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"lessThan": "a5b827dad8a3037cef04d0240d1c2acb1557101e",
"versionType": "git"
},
{
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"lessThan": "491df93b10d76aebaf6aa4bb05a6ba897f4fccfb",
"versionType": "git"
},
{
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"lessThan": "cc2ee642ebeac8699b671ddb6d5955a785e5ff43",
"versionType": "git"
},
{
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"lessThan": "68b786691ce24c5c94e28811db243e573c50f9c1",
"versionType": "git"
},
{
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"lessThan": "6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304",
"versionType": "git"
},
{
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"lessThan": "ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/cfg80211.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/cfg80211.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98190
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38273 · Revision 1
- Added to Heist Feed
- Publisher date