{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31780", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.141Z", "datePublished": "2026-05-01T14:15:07.253Z", "dateUpdated": "2026-08-05T12:25:08.895Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:08.895Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation\n\nThe variable valuesize is declared as u8 but accumulates the total\nlength of all SSIDs to scan. Each SSID contributes up to 33 bytes\n(IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10)\nSSIDs the total can reach 330, which wraps around to 74 when stored\nin a u8.\n\nThis causes kmalloc to allocate only 75 bytes while the subsequent\nmemcpy writes up to 331 bytes into the buffer, resulting in a 256-byte\nheap buffer overflow.\n\nWiden valuesize from u8 to u32 to accommodate the full range." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached by a local nl80211 generic-netlink trigger-scan request that supplies the probe SSID list. Over-the-air WiFi frames do not control this buffer.\nAC:L - The attacker can directly choose up to 10 SSIDs of up to 32 bytes each, reliably causing the u8 size wrap and heap overflow when scan is accepted. No race or hard-to-hit external condition is required.\nPR:L - NL80211_CMD_TRIGGER_SCAN is gated by GENL_UNS_ADMIN_PERM and netlink_ns_capable(..., CAP_NET_ADMIN), so namespace-scoped CAP_NET_ADMIN over the target wireless netns is sufficient. It is not reachable with no privileges.\nUI:N - No victim action is required once the attacker can issue the scan request. The attacker triggers the vulnerable code directly.\nS:U - The corruption occurs in the kernel while servicing a kernel wireless driver operation. It does not cross a VM, IOMMU, or other separate security authority boundary.\nC:H - The bug is a controlled kernel heap buffer overflow of up to 256 bytes, which can corrupt adjacent heap objects and plausibly support information disclosure during exploitation. Under the higher-severity rule, memory corruption is scored high for confidentiality.\nI:H - The attacker controls much of the data written past the undersized allocation into adjacent kernel heap memory. This is a kernel out-of-bounds write and is defensibly exploitable for integrity compromise.\nA:H - At minimum, the heap overflow can crash or oops the kernel, and it can be triggered repeatedly through scan requests. Kernel crash impact is high availability loss." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/microchip/wilc1000/hif.c" ], "versions": [ { "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "34a23fd9ddd683a03c7e8cc0ceded3e59e354b99", "status": "affected", "versionType": "git" }, { "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "549f02d8ec94d39092ab6d9b103d0d6783a4b024", "status": "affected", "versionType": "git" }, { "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "bfbddeadd4779651403035ee177ae2f22f9f5521", "status": "affected", "versionType": "git" }, { "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7", "status": "affected", "versionType": "git" }, { "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "c97b2a00059608592ad0d86fbb813a4f8cf9464b", "status": "affected", "versionType": "git" }, { "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "d8388614de613c28eeb659c10115060a83739924", "status": "affected", "versionType": "git" }, { "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "0c7f21d8bd2f93998b72b7a7f93152336aeca4dd", "status": "affected", "versionType": "git" }, { "version": "c5c77ba18ea66aa05441c71e38473efb787705a4", "lessThan": "d049e56b1739101d1c4d81deedb269c52a8dbba0", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/microchip/wilc1000/hif.c" ], "versions": [ { "version": "4.2", "status": "affected" }, { "version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.253" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.134" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.81" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.18.22" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.19.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/34a23fd9ddd683a03c7e8cc0ceded3e59e354b99" }, { "url": "https://git.kernel.org/stable/c/549f02d8ec94d39092ab6d9b103d0d6783a4b024" }, { "url": "https://git.kernel.org/stable/c/bfbddeadd4779651403035ee177ae2f22f9f5521" }, { "url": "https://git.kernel.org/stable/c/9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7" }, { "url": "https://git.kernel.org/stable/c/c97b2a00059608592ad0d86fbb813a4f8cf9464b" }, { "url": "https://git.kernel.org/stable/c/d8388614de613c28eeb659c10115060a83739924" }, { "url": "https://git.kernel.org/stable/c/0c7f21d8bd2f93998b72b7a7f93152336aeca4dd" }, { "url": "https://git.kernel.org/stable/c/d049e56b1739101d1c4d81deedb269c52a8dbba0" } ], "title": "wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation", "x_generator": { "engine": "bippy-1.2.0" } } } }