CVE-2026-31780wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
- 7.8HighCVSS base score
- 0.14%Exploitation in 30 daysEPSS · top 96% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation The variable valuesize is declared as u8 but accumulates the total length of all SSIDs to scan. Each SSID contributes up to 33 bytes (IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10) SSIDs the total can reach 330, which wraps around to 74 when stored in a u8. This causes kmalloc to allocate only 75 bytes while the subsequent memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte heap buffer overflow. Widen valuesize from u8 to u32 to accommodate the full range.
Timeline
ID reserved
By Linux
- 53 days later
· 53 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.14% · top 96% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected c5c77ba18ea66aa05441c71e38473efb787705a4 – < 34a23fd9ddd683a03c7e8cc0ceded3e59e354b99
- affected c5c77ba18ea66aa05441c71e38473efb787705a4 – < 549f02d8ec94d39092ab6d9b103d0d6783a4b024
- affected c5c77ba18ea66aa05441c71e38473efb787705a4 – < bfbddeadd4779651403035ee177ae2f22f9f5521
- affected c5c77ba18ea66aa05441c71e38473efb787705a4 – < 9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7
- affected c5c77ba18ea66aa05441c71e38473efb787705a4 – < c97b2a00059608592ad0d86fbb813a4f8cf9464b
- affected c5c77ba18ea66aa05441c71e38473efb787705a4 – < d8388614de613c28eeb659c10115060a83739924
- affected c5c77ba18ea66aa05441c71e38473efb787705a4 – < 0c7f21d8bd2f93998b72b7a7f93152336aeca4dd
- affected c5c77ba18ea66aa05441c71e38473efb787705a4 – < d049e56b1739101d1c4d81deedb269c52a8dbba0
- affected 4.2
- unaffected < 4.2
- unaffected 5.10.253 – ≤ 5.10.*
- unaffected 5.15.203 – ≤ 5.15.*
- unaffected 6.1.168 – ≤ 6.1.*
- unaffected 6.6.134 – ≤ 6.6.*
- unaffected 6.12.81 – ≤ 6.12.*
- unaffected 6.18.22 – ≤ 6.18.*
- unaffected 6.19.12 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References8
- https://git.kernel.org/stable/c/34a23fd9ddd683a03c7e8cc0ceded3e59e354b99 (opens in a new tab)
- https://git.kernel.org/stable/c/549f02d8ec94d39092ab6d9b103d0d6783a4b024 (opens in a new tab)
- https://git.kernel.org/stable/c/bfbddeadd4779651403035ee177ae2f22f9f5521 (opens in a new tab)
- https://git.kernel.org/stable/c/9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7 (opens in a new tab)
- https://git.kernel.org/stable/c/c97b2a00059608592ad0d86fbb813a4f8cf9464b (opens in a new tab)
- https://git.kernel.org/stable/c/d8388614de613c28eeb659c10115060a83739924 (opens in a new tab)
- https://git.kernel.org/stable/c/0c7f21d8bd2f93998b72b7a7f93152336aeca4dd (opens in a new tab)
- https://git.kernel.org/stable/c/d049e56b1739101d1c4d81deedb269c52a8dbba0 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-26593 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-31780)Record last updated .