Out-of-bounds write in Linux kernel - CVE-2026-98189

Vulnerability details

The vulnerability allows an attacker with physical access to corrupt neighboring kernel memory.

The vulnerability exists due to an out-of-bounds write in wilc_wlan_handle_isr_ext() in the wilc1000 wireless driver when processing receive transfers whose device-reported size exceeds the receive buffer capacity. An attacker with physical access can supply an oversized transfer containing controlled data through a bogus SDIO device to corrupt neighboring kernel memory.

The receive buffer is 96 KiB, while the device-reported transfer size can reach 131068 bytes. An oversized transfer can also leave the buffer offset beyond its end, allowing subsequent overflows to repeat.

Affected software

How to mitigate CVE-2026-98189

External References

• https://git.kernel.org/stable/c/14dcf4c3d74c878175b19d3da5986f83f26b1dd5
• https://git.kernel.org/stable/c/304a5d72a04a3979a6434088c8d9c5172c2a908e
• https://git.kernel.org/stable/c/3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26
• https://git.kernel.org/stable/c/4f86fb6f9dce04f697da85806ad96a932fc2f079
• https://git.kernel.org/stable/c/612ed9224eae70c53c0c88cb0990e0f9b709280a
• https://git.kernel.org/stable/c/9f6a276ade936a8803f9f3df217c2368944dc321
• https://git.kernel.org/stable/c/aeb44a456d126d89863230eef0187e77e6441995
• https://git.kernel.org/stable/c/c1ba7f7f18465e259cf1b4d9c73fc73853d7f790

Related Security Bulletins

• Out-of-bounds write in Linux kernel microchip wilc1000 driver
• Debian update for linux