KernelScan.io

HIGH

wifi wilc1000 SSID Overflow

CVE-2026-31780

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI7.8HIGH

01

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation The variable valuesize is declared as u8 but accumulates the total length of all SSIDs to scan. Each SSID contributes up to 33 bytes (IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10) SSIDs the total can reach 330, which wraps around to 74 when stored in a u8. This causes kmalloc to allocate only 75 bytes while the subsequent memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte heap buffer overflow. Widen valuesize from u8 to u32 to accommodate the full range.

02

Engine v0.2.0

Risk summary

Local attackers with low privileges can trigger a heap buffer overflow in the wilc1000 WiFi driver during SSID scanning operations. This can lead to kernel memory corruption, privilege escalation, or system crashes on devices using wilc1000 WiFi hardware.

Affecteddrivers/net/wireless/microchip/wilc1000/hif.c (wifi)

Vulnerability analysis

The root cause is an integer overflow in the valuesize variable (u8) that accumulates SSID lengths during WiFi scanning. With 10 SSIDs of maximum length (33 bytes each), the total reaches 330 bytes, which wraps to 74 when stored in u8. This causes kmalloc to allocate only 75 bytes while memcpy writes up to 331 bytes, creating a 256-byte heap overflow. The fix changes valuesize from u8 to u32 to prevent the overflow. Attack surface is local-only, requiring access to WiFi scanning functionality, typically available to low-privileged users through standard WiFi management interfaces.

03

BranchFixed inPatch commit
5.105.10.25334a23fd9ddd6
5.155.15.203549f02d8ec94
6.16.1.168bfbddeadd477
6.126.12.81c97b2a000596
6.186.18.22d8388614de61
6.196.19.120c7f21d8bd2f
6.66.6.1349907ac9b9a18
mainline7.0d049e56b1739