CVE-2026-31780: wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
The variable valuesize is declared as u8 but accumulates the total length of all SSIDs to scan. Each SSID contributes up to 33 bytes (IEEE80211MAXSSIDLEN + 1), and with WILCMAXNUMPROBEDSSID (10) SSIDs the total can reach 330, which wraps around to 74 when stored in a u8.
This causes kmalloc to allocate only 75 bytes while the subsequent memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte heap buffer overflow.
Widen valuesize from u8 to u32 to accommodate the full range.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel wifi: wilc1000 SSID scan buffer size calculation, widen the valuesize variable from u8 to u32 so it can accommodate the full SSID length range.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31780?
CVE-2026-31780 has been classified as a medium severity vulnerability affecting the wilc1000 component of the Linux kernel.
How do I fix CVE-2026-31780?
To fix CVE-2026-31780, ensure that you update your Linux kernel to the latest version where this vulnerability is patched.
What impact does CVE-2026-31780 have on my system?
CVE-2026-31780 could potentially lead to buffer overflow vulnerabilities, resulting in unexpected behavior or crashes in the WiFi subsystem.
Is CVE-2026-31780 specific to certain Linux kernel versions?
CVE-2026-31780 affects certain versions of the Linux kernel that utilize the wilc1000 driver for WiFi functionality.
How can I verify if my system is affected by CVE-2026-31780?
You can verify if your system is affected by CVE-2026-31780 by checking the version of the Linux kernel and looking for updates that address this vulnerability.