{"cve":"CVE-2026-22978","nvd":{"published":"2026-01-23T16:15:53.783","modified":"2026-06-17T10:20:38.110","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: avoid kernel-infoleak from struct iw_point\n\nstruct iw_point has a 32bit hole on 64bit arches.\n\nstruct iw_point {\n  void __user   *pointer;       /* Pointer to the data  (in user space) */\n  __u16         length;         /* number of fields or size in bytes */\n  __u16         flags;          /* Optional params */\n};\n\nMake sure to zero the structure to avoid disclosing 32bits of kernel data\nto user space.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.3},"cwes":[],"references":["https://git.kernel.org/stable/c/024f71a57d563fbe162e528c8bf2d27e9cac7c7b","https://git.kernel.org/stable/c/21cbf883d073abbfe09e3924466aa5e0449e7261","https://git.kernel.org/stable/c/442ceac0393185e9982323f6682a52a53e8462b1","https://git.kernel.org/stable/c/a3827e310b5a73535646ef4a552d53b3c8bf74f6","https://git.kernel.org/stable/c/d21ec867d84c9f3a9845d7d8c90c9ce35dbe48f8"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:21:16.563232421+00:00"},"epss":{"cve":"CVE-2026-22978","score":0.00138,"percentile":0.03147,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}