# wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()

CVE record · `CVE-2026-98189`

- **Identifiers:** `CVE-2026-98189`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 6 Oct 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 6 Oct 2026, 08:44 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `c5c77ba18ea66aa05441c71e38473efb787705a4 to before 3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26` (git)
  - affected: `c5c77ba18ea66aa05441c71e38473efb787705a4 to before 9f6a276ade936a8803f9f3df217c2368944dc321` (git)
  - affected: `c5c77ba18ea66aa05441c71e38473efb787705a4 to before aeb44a456d126d89863230eef0187e77e6441995` (git)
  - affected: `c5c77ba18ea66aa05441c71e38473efb787705a4 to before 612ed9224eae70c53c0c88cb0990e0f9b709280a` (git)
  - affected: `c5c77ba18ea66aa05441c71e38473efb787705a4 to before 304a5d72a04a3979a6434088c8d9c5172c2a908e` (git)
  - affected: `c5c77ba18ea66aa05441c71e38473efb787705a4 to before 4f86fb6f9dce04f697da85806ad96a932fc2f079` (git)
  - affected: `c5c77ba18ea66aa05441c71e38473efb787705a4 to before 14dcf4c3d74c878175b19d3da5986f83f26b1dd5` (git)
  - affected: `c5c77ba18ea66aa05441c71e38473efb787705a4 to before c1ba7f7f18465e259cf1b4d9c73fc73853d7f790` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.2`
  - unaffected: `before 4.2` (semver)
  - unaffected: `5.10.271 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.222 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.189 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.158 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.112 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.54 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.8 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0018, the 7th percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 6 Oct 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-98189](https://www.cve.org/CVERecord?id=CVE-2026-98189)
- [NVD: CVE-2026-98189](https://nvd.nist.gov/vuln/detail/CVE-2026-98189)

### References from the CNA

- <https://git.kernel.org/stable/c/3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26>
- <https://git.kernel.org/stable/c/9f6a276ade936a8803f9f3df217c2368944dc321>
- <https://git.kernel.org/stable/c/aeb44a456d126d89863230eef0187e77e6441995>
- <https://git.kernel.org/stable/c/612ed9224eae70c53c0c88cb0990e0f9b709280a>
- <https://git.kernel.org/stable/c/304a5d72a04a3979a6434088c8d9c5172c2a908e>
- <https://git.kernel.org/stable/c/4f86fb6f9dce04f697da85806ad96a932fc2f079>
- <https://git.kernel.org/stable/c/14dcf4c3d74c878175b19d3da5986f83f26b1dd5>
- <https://git.kernel.org/stable/c/c1ba7f7f18465e259cf1b4d9c73fc73853d7f790>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-98189>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-98189/>. Everything for agents: <https://agentprime.io/llms.txt>.