CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal
Heap out-of-bounds write in Linux kernel RSI WiFi driver during key removal allows attackers to corrupt memory, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98407?
CVE-2026-98407 is a memory corruption vulnerability in Linux, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi: fix heap OOB write on key removal
When a key is removed (data == NULL), rsi_hal_load_key() runs:
memset(&set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ);
set_key is a struct rsi_set_key *, so the subscript is scaled by sizeof(struct rsi_set_key) (160 bytes): &set_key[FRAME_DESC_SZ] is skb->data + 2560, and the memset writes 144 zero bytes starting 2.4KB past the end of the 160-byte skb data buffer, corrupting unrelated heap objects. The intended byte offset would have been (u8 *)set_key + FRAME_DESC_SZ.
The write fires on every DISABLE_KEY callback, so plain disconnects, roams and interface teardowns trigger it on real networks.
The memset is redundant: the whole buffer is zeroed right after allocation, so the frame sent to the device is byte-identical without it. Drop the else branch; normal operation is unaffected.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Which versions are affected by CVE-2026-98407?
How do I fix CVE-2026-98407?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98407 being exploited?
There is no known exploitation of CVE-2026-98407 in the wild and no public exploit code.
Sources
Also known as AZL-108116, BELL-CVE-2026-98407, DEBIAN-CVE-2026-98407, GHSA-5p9q-rqwh-2www, UBUNTU-CVE-2026-98407.