Out-of-bounds read in Linux kernel - CVE-2026-98190

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the wilc1000 driver's wilc_wfi_p2p_rx() and mgmt_tx() functions when processing public action frames shorter than the 32-byte P2P public action header. A remote attacker can transmit a specially crafted 25- to 31-byte public action frame over the air to cause a denial of service.

Exploitation through the receive path requires the host to be in P2P listen mode. No wireless association is required.

Affected software

How to mitigate CVE-2026-98190

External References

• https://git.kernel.org/stable/c/491df93b10d76aebaf6aa4bb05a6ba897f4fccfb
• https://git.kernel.org/stable/c/68b786691ce24c5c94e28811db243e573c50f9c1
• https://git.kernel.org/stable/c/6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304
• https://git.kernel.org/stable/c/a5b827dad8a3037cef04d0240d1c2acb1557101e
• https://git.kernel.org/stable/c/ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14
• https://git.kernel.org/stable/c/cc2ee642ebeac8699b671ddb6d5955a785e5ff43
• https://git.kernel.org/stable/c/e98ad9f4c59f2e836f8d971b57763a4277680422
• https://git.kernel.org/stable/c/f0c46f8111a479b97b8ab17747c528cade6257f1

Related Security Bulletins

• Out-of-bounds read in Linux kernel microchip wilc1000 driver
• Debian update for linux