Out-of-bounds write in Linux kernel - CVE-2026-98407

Vulnerability details

The vulnerability allows a local user to corrupt unrelated kernel heap objects.

The vulnerability exists due to incorrect pointer arithmetic resulting in an out-of-bounds write in the rsi_hal_load_key() function when removing a key with a null data pointer. A local user can trigger a key-removal operation to corrupt unrelated kernel heap objects.

The write occurs on every DISABLE_KEY callback, including during disconnects, roaming, and interface teardown. It writes 144 zero bytes approximately 2.4 KB beyond the end of a 160-byte heap buffer.

Affected software

How to mitigate CVE-2026-98407

External References

• https://git.kernel.org/stable/c/00bea3589255603c38766cac4a4d6d36493b2556
• https://git.kernel.org/stable/c/62d40db89180cfab7a917395f9ffc1dac62b0019
• https://git.kernel.org/stable/c/8dab6ee020b2cd951b670626ba44a95cd4deac3d
• https://git.kernel.org/stable/c/ac599cf8edf8aa2dae546f04d3f1849e32c2e738
• https://git.kernel.org/stable/c/b79e2f6585c014c42384f4caa7a37b3e5d26179c
• https://git.kernel.org/stable/c/c67fb3b875a83f9ba92afea4036c7b541f77512a
• https://git.kernel.org/stable/c/e6c5ed7a98d7bc8b0f7918246f1c90ddb3f79dfa
• https://git.kernel.org/stable/c/f4f2852b664c3ff1436785cd11258a0ce25b74b3

Related Security Bulletins

• Out-of-bounds write in Linux kernel wireless rsi driver
• Debian update for linux