Security readout for executives and security teams
Plain-English summary
A size calculation in the Linux WILC1000 Wi-Fi driver can wrap at 255 bytes when scanning multiple SSIDs. The kernel may allocate 75 bytes and then copy as many as 331 bytes, corrupting nearby heap memory. A successful trigger could crash the device or potentially compromise the kernel, affecting confidentiality, integrity, and availability.
Executive priority
Prioritize affected embedded, appliance, and Linux systems where WILC1000 Wi-Fi is active and local users or services are not fully trusted. Treat remediation as high priority because kernel memory corruption can have system-wide impact. Reduce urgency for systems proven not to include or load this driver, while documenting that validation.
Technical view
The driver stores the combined SSID scan-buffer length in an 8-bit variable. Ten SSIDs can require 330 bytes, causing the value to wrap to 74. Allocation includes one additional byte, producing a 75-byte buffer before a copy of up to 331 bytes. The upstream correction widens the size variable from u8 to u32.
Likely exposure
Exposure is most likely on Linux systems using the WILC1000 wireless driver and a kernel lacking the relevant stable fix. Systems without this driver or hardware are unlikely to be exposed. The supplied version data is ambiguous, so distribution package versions and backports must be confirmed with vendors rather than inferred from upstream version numbers alone.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. Neither KEV status nor the supplied sources establish active exploitation. The bundle does not fully document how an unprivileged actor reaches the vulnerable scan operation, so practical exploitability may depend on driver configuration and local interface permissions.
Researcher notes
The deterministic fault is a 256-byte heap overwrite caused by unsigned 8-bit truncation: 330 becomes 74, allocation becomes 75, and copying can reach 331 bytes. Impact is rated high, but the supplied material provides no public exploit evidence, attack-path analysis, or affected distribution mapping. Assess reachability without assuming every upstream-listed kernel is vulnerable after vendor backports.
Mitigation direction
- Update to a vendor-supported kernel package containing the applicable stable fix.
- Confirm backport status with the operating-system or device vendor.
- Disable or unload the WILC1000 driver where operationally unnecessary.
- Restrict local access to affected systems until remediation is verified.
Validation and detection
- Inventory systems for installed or active WILC1000 kernel-driver support.
- Record running kernel and distribution package versions on potentially affected devices.
- Verify the vendor package includes the applicable referenced kernel fix.
- Confirm the corrected source uses a sufficiently wide scan-buffer size variable.
- After updating, verify the fixed kernel is running and the device operates normally.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31780 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/34a23fd9ddd683a03c7e8cc0ceded3e59e354b99CVE reference, Linux
- https://git.kernel.org/stable/c/549f02d8ec94d39092ab6d9b103d0d6783a4b024CVE reference, Linux
- https://git.kernel.org/stable/c/bfbddeadd4779651403035ee177ae2f22f9f5521CVE reference, Linux
- https://git.kernel.org/stable/c/9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7CVE reference, Linux
- https://git.kernel.org/stable/c/c97b2a00059608592ad0d86fbb813a4f8cf9464bCVE reference, Linux
- https://git.kernel.org/stable/c/d8388614de613c28eeb659c10115060a83739924CVE reference, Linux
- https://git.kernel.org/stable/c/0c7f21d8bd2f93998b72b7a7f93152336aeca4ddCVE reference, Linux
- https://git.kernel.org/stable/c/d049e56b1739101d1c4d81deedb269c52a8dbba0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.