CVE-2026-31780

wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation

State: Published
Severity: 7.8 High
Published: May 1, 2026
Updated: Aug 5, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation

The variable valuesize is declared as u8 but accumulates the total length of all SSIDs to scan. Each SSID contributes up to 33 bytes (IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10) SSIDs the total can reach 330, which wraps around to 74 when stored in a u8.

This causes kmalloc to allocate only 75 bytes while the subsequent memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte heap buffer overflow.

Widen valuesize from u8 to u32 to accommodate the full range.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c5c77ba18ea66aa05441c71e38473efb787705a4 to before 34a23fd9ddd683a03c7e8cc0ceded3e59e354b99Affected c5c77ba18ea66aa05441c71e38473efb787705a4 to before 549f02d8ec94d39092ab6d9b103d0d6783a4b024Affected c5c77ba18ea66aa05441c71e38473efb787705a4 to before bfbddeadd4779651403035ee177ae2f22f9f5521Affected c5c77ba18ea66aa05441c71e38473efb787705a4 to before 9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7Affected c5c77ba18ea66aa05441c71e38473efb787705a4 to before c97b2a00059608592ad0d86fbb813a4f8cf9464bAffected c5c77ba18ea66aa05441c71e38473efb787705a4 to before d8388614de613c28eeb659c10115060a83739924Affected c5c77ba18ea66aa05441c71e38473efb787705a4 to before 0c7f21d8bd2f93998b72b7a7f93152336aeca4ddAffected c5c77ba18ea66aa05441c71e38473efb787705a4 to before d049e56b1739101d1c4d81deedb269c52a8dbba0Affected
LinuxLinux	4.2Affected before 4.2Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

c5c77ba18ea66aa05441c71e38473efb787705a4 to before 34a23fd9ddd683a03c7e8cc0ceded3e59e354b99Affected
c5c77ba18ea66aa05441c71e38473efb787705a4 to before 549f02d8ec94d39092ab6d9b103d0d6783a4b024Affected
c5c77ba18ea66aa05441c71e38473efb787705a4 to before bfbddeadd4779651403035ee177ae2f22f9f5521Affected
c5c77ba18ea66aa05441c71e38473efb787705a4 to before 9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7Affected
c5c77ba18ea66aa05441c71e38473efb787705a4 to before c97b2a00059608592ad0d86fbb813a4f8cf9464bAffected
c5c77ba18ea66aa05441c71e38473efb787705a4 to before d8388614de613c28eeb659c10115060a83739924Affected
c5c77ba18ea66aa05441c71e38473efb787705a4 to before 0c7f21d8bd2f93998b72b7a7f93152336aeca4ddAffected
c5c77ba18ea66aa05441c71e38473efb787705a4 to before d049e56b1739101d1c4d81deedb269c52a8dbba0Affected

LinuxLinux

4.2Affected
before 4.2Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.