CVE-2026-98190 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix out-of-bounds read in P2P public action frames
wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once ieee80211_is_public_action() returns true. That helper only verifies the frame is long enough for the action category field, that is offsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both functions then read the P2P public action header up to oui_subtype at offset 30 and pass "size - ie_offset" to cfg80211_find_vendor_ie(), where ie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32.
A public action frame of 25 to 31 bytes passes the check but is shorter than that 32 byte header, so oui_subtype can be read out of bounds, and because the length is unsigned, "size - ie_offset" underflows to a value close to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length, so even the size_t subtraction in mgmt_tx() is truncated to the same value. It then walks far past the buffer searching for a vendor element until it reaches unmapped memory.
In the receive path the frame arrives over the air and needs no association, so a nearby unauthenticated device can crash the host while it is in P2P listen. Reject frames shorter than the P2P public action header in both paths before dereferencing it.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The Linux kernel vulnerability identified within the wilc1000 wireless driver involves an out-of-bounds read resulting from insufficient validation of frame lengths during the processing of Wi-Fi Protected Setup (WPS) and Peer-to-Peer (P2P) public action frames. The core technical flaw resides in two specific functions, wilc_wfi_p2p_rx() and mgmt_tx(), which are responsible for handling incoming and outgoing management traffic respectively. These functions rely on the helper function ieee80211_is_public_action to determine if a received frame is of the public action type. This helper performs a basic sanity check by verifying that the frame length exceeds twenty-five bytes, which corresponds to the offset end of the action category field within the IEEE 802.11 management frame structure. However this validation is critically insufficient because subsequent code logic attempts to access data structures that extend beyond this minimal threshold.
Specifically both functions proceed to parse a P2P public action header that requires at least thirty-two bytes to be safely accessed, as it includes fields such as oui_subtype located at offset thirty-two from the start of the management frame body. When an attacker crafts or intercepts a malicious public action frame with a length between twenty-five and thirty-one bytes, the initial check passes but the subsequent dereference accesses memory outside the allocated buffer boundaries. This constitutes a classic out-of-bounds read vulnerability where sensitive kernel memory may be exposed depending on what resides immediately after the packet buffer in physical RAM. The severity of this issue is compounded by integer arithmetic errors that occur when calculating the length parameter for further processing functions.
The operational impact escalates significantly due to how the code handles size calculations following the out-of-bounds read. Both wilc_wfi_p2p_rx() and mgmt_tx pass a calculated value derived from subtracting an offset of thirty-two bytes from the total frame size to cfg801_find_vendor_ie(). Because the frame size is less than thirty-two bytes in this exploit scenario, the subtraction results in a negative number. Since these variables are treated as unsigned integers, the result wraps around to a very large positive value close to four gigabytes. This underflowed length is then passed into cfg80211_find_vendor_ie(), which accepts an unsigned integer for its length parameter. Consequently this function attempts to scan through memory space far exceeding the actual buffer size in search of specific vendor information elements.
This excessive memory traversal leads to a severe denial of service condition as the kernel eventually accesses unmapped or protected memory regions, triggering a page fault and causing a system crash or panic. In the receive path, wilc_wfi_p2p_rx() processes frames arriving over the air interface without requiring any prior authentication or association with an access point. This architectural characteristic means that a nearby unauthenticated attacker can trigger this vulnerability simply by transmitting crafted P2P public action frames while the host device is in P2P listen mode. The ability to crash the system remotely via wireless signals represents a significant threat to availability and stability, particularly for devices relying on Wi-Fi Direct or similar peer-to-peer networking features.
To mitigate this risk, developers must implement strict length validation before attempting to parse any fields within public action frames. Specifically both wilc_wfi_p2p_rx() and mgmt_tx should verify that the incoming frame size is at least thirty-two bytes prior to accessing the oui_subtype field or performing subsequent arithmetic operations on frame lengths. This ensures that all structural accesses remain within valid memory boundaries and prevents integer underflow scenarios that lead to excessive memory traversal. Such fixes align with secure coding practices recommended by industry standards, particularly addressing CWE-125 Out-of-bounds Read which describes reading data beyond the end of a buffer, and CWE-190 Integer Overflow or Wraparound which covers the arithmetic errors exploited in this flaw.
From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates remote code execution potential through information disclosure via memory contents read during the out-of-bounds access, although it is primarily observed as a denial of service vector due to immediate crashes. The attack technique corresponds to T1059 Command and Scripting Interpreter if exploitation leads to further payload delivery or more directly aligns with resource exhaustion tactics used in wireless network attacks. Securing these parsing routines against malformed inputs is essential for maintaining the integrity of Linux-based embedded systems and IoT devices that utilize the wilc1000 chipset, ensuring they remain resilient against maliciously crafted wireless frames designed to exploit parser logic flaws.