Linux rsi_shutdown() DoS

The vulnerability in the rsishutdown function within the drivers/net/wireless/rsi/rsi91xsdio.c component of the Linux kernel operating system is related to insufficient resource control during its existence. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46187)

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix kthread lifetime race between self-exit and external-stop RSI driver use both self-exitkthreadcompleteandexit and external-stop kthreadstop when killing a kthread. Generally, kthreadstop is called first, and in thi...

CVE-2026-98407

A flaw was found in the Linux kernel's Redpine Signals Inc. rsi wireless driver. An incorrect memory offset calculation during encryption key removal causes data to be written past the allocated buffer, corrupting kernel heap memory. This issue is triggered during routine wireless events such as...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix kthread lifetime race between self-exit and external-stop The RSI driver uses both self-exitkthreadcompleteandexit and external-stopkthreadstop when terminating a kthread. Typically, kthreadstop is called first; in...

SUSE CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

AZL-108116 CVE-2026-98407 affecting package kernel for versions less than 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

DEBIAN-CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

UBUNTU-CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407

The Linux kernel contains a heap Out-of-Bounds (OOB) write vulnerability in the wifi: rsi component. The issue occurs within the rsi_hal_load_key() function when a key is removed (where data == NULL). Because the set_key pointer is typed as struct rsi_set_key *, the subscripting operation scales ...

EUVD-2026-101056

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

Linux Distros Unpatched Vulnerability : CVE-2026-98407

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ...

PT-2026-114386

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds OOB write occurs in the rsi hal load key function during key removal when data is NULL. The issue stems from an incorrect subscript calculation where set key is...

CVE-2026-98407: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-93802

A flaw was found in the Linux kernel's Redpine Signals rsi Wi-Fi driver. The driver fails to validate the length of a beacon frame against available buffer space before copying data into a management buffer. An attacker could exploit this issue by triggering the transmission or processing of an...

CVE-2026-93266

A flaw was found in the Linux kernel's ARM64 Realm Services Interface RSI component. When copying attestation challenge data into register structures, the kernel performs a write operation across adjacent structure fields, triggering a memory safety warning from the fortified memory copying...