All vulnerabilities
CVE-2026-98407

Linux: wifi: rsi: fix heap OOB write on key removal

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in62d40db89180cfab7a917395f9ffc1dac62b0019Also 00bea3589255603c38766cac4a4d6d36493b2556, 8dab6ee020b2cd951b670626ba44a95cd4deac3dCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 62d40db89180cfab7a917395f9ffc1dac62b0019LinuxCVE List
  • 00bea3589255603c38766cac4a4d6d36493b2556LinuxCVE List
  • 8dab6ee020b2cd951b670626ba44a95cd4deac3dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rsi: fix heap OOB write on key removal

When a key is removed (data == NULL), rsi_hal_load_key() runs:

memset(&set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ);

set_key is a struct rsi_set_key *, so the subscript is scaled by sizeof(struct rsi_set_key) (160 bytes): &set_key[FRAME_DESC_SZ] is skb->data + 2560, and the memset writes 144 zero bytes starting 2.4KB past the end of the 160-byte skb data buffer, corrupting unrelated heap objects. The intended byte offset would have been (u8 *)set_key + FRAME_DESC_SZ.

The write fires on every DISABLE_KEY callback, so plain disconnects, roams and interface teardowns trigger it on real networks.

The memset is redundant: the whole buffer is zeroed right after allocation, so the frame sent to the device is byte-identical without it. Drop the else branch; normal operation is unaffected.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

Text from CVE List

Affected versions 18

  • Linuxaffected: dad0d04fa7ba41ce603a01e8e64967650303e9a2 before b79e2f6585c014c42384f4caa7a37b3e5d26179cCVE List
  • Linuxaffected: dad0d04fa7ba41ce603a01e8e64967650303e9a2 before c67fb3b875a83f9ba92afea4036c7b541f77512aCVE List
  • Linuxaffected: dad0d04fa7ba41ce603a01e8e64967650303e9a2 before 62d40db89180cfab7a917395f9ffc1dac62b0019CVE List
  • Linuxaffected: dad0d04fa7ba41ce603a01e8e64967650303e9a2 before 00bea3589255603c38766cac4a4d6d36493b2556CVE List
  • Linuxaffected: dad0d04fa7ba41ce603a01e8e64967650303e9a2 before ac599cf8edf8aa2dae546f04d3f1849e32c2e738CVE List
  • Linuxaffected: dad0d04fa7ba41ce603a01e8e64967650303e9a2 before f4f2852b664c3ff1436785cd11258a0ce25b74b3CVE List
  • Linuxaffected: dad0d04fa7ba41ce603a01e8e64967650303e9a2 before 8dab6ee020b2cd951b670626ba44a95cd4deac3dCVE List
  • Linuxaffected: dad0d04fa7ba41ce603a01e8e64967650303e9a2 before e6c5ed7a98d7bc8b0f7918246f1c90ddb3f79dfaCVE List
  • Linuxaffected: 3.15CVE List
  • Linuxunaffected: all versions before 3.15CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8