Executive brief
A vulnerability exists in the Linux kernel driver for Microchip WILC1000 wireless network cards. An error in how the system calculates memory requirements for Wi-Fi network scans can lead to a memory overflow. This could allow a local attacker to crash the system or potentially gain unauthorized elevated privileges.
Technical details
A heap buffer overflow exists in the wilc1000 driver within the wilc_scan function in drivers/net/wireless/microchip/wilc1000/hif.c. The variable 'valuesize' was incorrectly declared as a u8 (8-bit unsigned integer), which has a maximum value of 255. When calculating the total length of up to 10 SSIDs (each up to 33 bytes), the total can reach 330, causing the u8 to wrap around to 74. This results in kmalloc allocating an undersized buffer while a subsequent memcpy writes up to 331 bytes, leading to a 256-byte heap overflow. The vulnerability is fixed by widening 'valuesize' to a u32.
Affected products
- Linux Linux Kernel 4.2 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.134, 6.7 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-03-24: other: Patch submitted by developer
- 2026-04-11: patched: Patch committed to stable trees
- 2026-05-01: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0c7f21d8bd2f93998b72b7a7f93152336aeca4dd
- https://git.kernel.org/stable/c/34a23fd9ddd683a03c7e8cc0ceded3e59e354b99
- https://git.kernel.org/stable/c/549f02d8ec94d39092ab6d9b103d0d6783a4b024
- https://git.kernel.org/stable/c/9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7
- https://git.kernel.org/stable/c/bfbddeadd4779651403035ee177ae2f22f9f5521
- https://git.kernel.org/stable/c/c97b2a00059608592ad0d86fbb813a4f8cf9464b
- https://git.kernel.org/stable/c/d049e56b1739101d1c4d81deedb269c52a8dbba0