CVE-2026-98407

Received Received - Intake

Heap OOB Write in Linux Kernel WiFi Driver

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed (data == NULL), rsi_hal_load_key() runs: memset(&set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ); set_key is a struct rsi_set_key *, so the subscript is scaled by sizeof(struct rsi_set_key) (160 bytes): &set_key[FRAME_DESC_SZ] is skb->data + 2560, and the memset writes 144 zero bytes starting 2.4KB past the end of the 160-byte skb data buffer, corrupting unrelated heap objects. The intended byte offset would have been (u8 *)set_key + FRAME_DESC_SZ. The write fires on every DISABLE_KEY callback, so plain disconnects, roams and interface teardowns trigger it on real networks. The memset is redundant: the whole buffer is zeroed right after allocation, so the frame sent to the device is byte-identical without it. Drop the else branch; normal operation is unaffected. Discovered by Atuin - Automated Vulnerability Discovery Engine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98407

EUVD

EUVD-2026-101056

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	dad0d04fa7ba41ce603a01e8e64967650303e9a2
Linux	Linux	dad0d04fa7ba41ce603a01e8e64967650303e9a2
Linux	Linux	dad0d04fa7ba41ce603a01e8e64967650303e9a2
Linux	Linux	dad0d04fa7ba41ce603a01e8e64967650303e9a2
Linux	Linux	dad0d04fa7ba41ce603a01e8e64967650303e9a2
Linux	Linux	dad0d04fa7ba41ce603a01e8e64967650303e9a2
Linux	Linux	dad0d04fa7ba41ce603a01e8e64967650303e9a2
Linux	Linux	dad0d04fa7ba41ce603a01e8e64967650303e9a2
Linux	Linux	3.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap out-of-bounds (OOB) write vulnerability in the Linux kernel's wifi driver (rsi). When a network key is removed, the function rsi_hal_load_key incorrectly writes 144 zero bytes 2.4KB past the end of a 160-byte buffer, corrupting unrelated heap objects. The issue stems from incorrect pointer arithmetic where the offset was scaled by the struct size (160 bytes) instead of using a byte pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's wifi rsi driver and triggers during key removal operations like disconnects or interface teardowns. Detection requires checking kernel logs for heap corruption errors or OOB writes related to rsi_set_key structures. Monitor dmesg or journalctl for memory corruption warnings.

Impact Analysis

This vulnerability could lead to system instability, crashes, or potential privilege escalation if exploited. Since it triggers on common operations like disconnecting from WiFi, roaming between networks, or shutting down interfaces, it may affect normal device usage and reliability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a heap out-of-bounds write in the Linux kernel's wifi driver (rsi) that could corrupt unrelated heap objects during key removal operations. No evidence suggests it impacts data confidentiality, integrity, or availability in a way that would violate these regulations.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this issue. If updating is not immediately possible, disable the rsi wifi driver module by running 'modprobe -r rsi_usb' or 'modprobe -r rsi_sdio' depending on your hardware. Avoid using wifi networks until the kernel is patched.

Hi! I’m here to help you understand CVE-2026-98407. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70