Out-of-Bounds Write in Linux kernel (CVE-2026-31780, CVSS 7.8)

Summary

Out-of-bounds write in Linux kernel (CVE-2026-31780). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation

The variable valuesize is declared as u8 but accumulates the total
length of all SSIDs to scan. Each SSID contributes up to 33 bytes
(IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10)
SSIDs the total can reach 330, which wraps around to 74 when stored
in a u8.

This causes kmalloc to allocate only 75 bytes while the subsequent
memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte
heap buffer overflow.

Widen valuesize from u8 to u32 to accommodate the full range.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

Linuxカーネルにおいて、wilc1000のSSIDスキャンバッファサイズ計算でu8のオーバーフロー脆弱性が修正されました。この問題は、valuesize変数が最大331バイトの書き込みを引き起こし、結果として256バイトのヒープバッファオーバーフローを引き起こす可能性があります。修正は、valuesizeをu32に拡幅することで行われました。

❓ What is the problem

LinuxカーネルのSSIDスキャンバッファサイズ計算におけるu8オーバーフロー

📍 Affected scope

wifi: wilc1000モジュール

🔥 Severity

u8オーバーフローによりヒープバッファオーバーフローが発生し、システムの安定性やセキュリティを損なう可能性がある

🔧 How to fix

valuesize変数をu8からu32に拡幅するパッチを適用

🛡️ Workaround

情報なし

🔍 Detection

Linuxカーネルの該当バージョンを確認し、パッチの適用状態を確認

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"5.10.253"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.203"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.168"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.134"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.81"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.22"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.12"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-31780 linux-lts Fixed in: 6.1.168-r0
Debian DEBIAN-CVE-2026-31780 linux Fixed in: 5.10.257-1
Ubuntu UBUNTU-CVE-2026-31780 linux-aws

Out-of-Bounds Write in Linux kernel (CVE-2026-31780)

Summary

Original description

AI summary

Affected packages

Fix status by distribution

References