CVE-2026-31780: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31780 is an integer overflow and heap buffer overflow vulnerability in the Linux kernel's WILC1000 WiFi driver, specifically in the SSID scan buffer size calculation. The variable valuesize is declared as u8 but accumulates the total length of all SSIDs to scan; with up to 10 SSIDs (WILC_MAX_NUM_PROBED_SSID) each contributing up to 33 bytes, the total can reach 330 bytes, which wraps around to 74 when stored in a u8. This causes kmalloc to allocate only 75 bytes while a subsequent memcpy writes up to 331 bytes, resulting in a 256-byte heap buffer overflow. Affected kernel versions span from 4.2 through multiple stable branches up to 6.19, 6.18, 6.12, 6.6, 6.1, 5.15, and 5.10 (before their respective patched releases). It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-190 (Integer Overflow or Wraparound) leading to CWE-787 (Out-of-bounds Write). In the WILC1000 driver's SSID scan path, valuesize is a u8 variable that accumulates the byte count of all probe SSIDs; since u8 can hold a maximum of 255, adding lengths for up to 10 SSIDs (each up to 33 bytes, totaling up to 330) causes an integer wraparound to 74. The subsequent kmalloc(valuesize + 1) call allocates only 75 bytes, but the memcpy that follows writes the full SSID data (up to 331 bytes) into this undersized buffer, overflowing the heap. Exploitation requires local access to trigger a WiFi scan with the maximum number of probe SSIDs on a system using the WILC1000 driver (GitHub Advisory).

Successful exploitation of this heap buffer overflow can result in memory corruption that may lead to information disclosure, denial of service (kernel crash), or local privilege escalation, depending on heap layout and attacker capabilities. The vulnerability is confined to systems using the WILC1000 WiFi driver (commonly found in embedded and IoT devices), and exploitation requires local access to initiate a WiFi scan operation. The confidentiality, integrity, and availability of the affected system are all potentially at risk (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.03%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access and the presence of the WILC1000 WiFi driver, which limits the attack surface primarily to embedded and IoT Linux systems.

The Linux kernel maintainers have released patches across all affected stable branches. Fixed versions include: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. Patch commits are available on kernel.org for each stable branch. As a workaround until patching is possible, administrators should restrict WiFi scanning operations on systems using the WILC1000 driver and monitor for abnormal driver behavior or kernel crashes. Upgrading to a patched kernel version is the recommended remediation (GitHub Advisory, Red Hat Bugzilla).