CVE-2026-98407

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rsi: fix heap OOB write on key removal

When a key is removed (data == NULL), rsi_hal_load_key() runs:

memset(&set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ);

set_key is a struct rsi_set_key *, so the subscript is scaled by

sizeof(struct rsi_set_key) (160 bytes): &set_key[FRAME_DESC_SZ] is

skb->data + 2560, and the memset writes 144 zero bytes starting

2.4KB past the end of the 160-byte skb data buffer, corrupting

unrelated heap objects. The intended byte offset would have been

(u8 *)set_key + FRAME_DESC_SZ.

The write fires on every DISABLE_KEY callback, so plain disconnects,

roams and interface teardowns trigger it on real networks.

The memset is redundant: the whole buffer is zeroed right after

allocation, so the frame sent to the device is byte-identical

without it. Drop the else branch; normal operation is unaffected.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References