CVE-2026-98711
Received Received - Intake

Heap Data Leak via TX Padding in cw1200 WiFi Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment (align_size(), up to 511 bytes for SDIO, 1 byte for SPI) but sends the padded length straight from the frame buffer, which has no room reserved for the padding. cw1200_data_write() therefore reads past the end of the frame and the bus transfer carries those bytes to the device. A bogus device can collect up to 511 bytes of kernel heap data per TX frame. The RX path does not have this problem: it allocates the skb with the aligned length (alloc_len) before reading. Compute the exact padding with the bus align_size() callback, make sure queued TX frames have tailroom for it, and zero the padding bytes before the transfer so nothing past the frame is exposed. This is not expected to change driver behavior on most cases: frame contents and transfer sizes are unchanged, only the content of the padding bytes (previously undefined stale memory, now zero), which the device never reads since the WSM header carries the real frame length. The skb expansion can only fail under memory exhaustion, in which case the frame is dropped like on the existing error paths of cw1200_tx(). Discovered by Atuin - Automated Vulnerability Discovery Engine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98711
EUVD
EUVD-2026-103965

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux a910e4a94f6923c8c988565525f017f687bf7205
Linux Linux a910e4a94f6923c8c988565525f017f687bf7205
Linux Linux a910e4a94f6923c8c988565525f017f687bf7205
Linux Linux a910e4a94f6923c8c988565525f017f687bf7205
Linux Linux 3.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow in the cw1200 WiFi driver. When transmitting data, the driver pads the frame size to align with bus requirements but fails to reserve space in the frame buffer for this padding. This causes the driver to read past the end of the frame, exposing up to 511 bytes of kernel heap data to the device. The padding bytes are not zeroed, allowing stale memory contents to be sent.

Detection Guidance

This vulnerability affects the Linux kernel's cw1200 WiFi driver. Detection requires checking if your system uses this driver and if the kernel version is vulnerable. Use commands like 'lsmod | grep cw1200' to check if the driver is loaded and 'uname -a' to verify your kernel version. Compare the version against patched releases.

Impact Analysis

An attacker within WiFi range could exploit this to capture sensitive kernel heap data transmitted over the network. This may include passwords, encryption keys, or other confidential information. The impact is limited to data exposure during active transmissions and does not allow arbitrary code execution.

Compliance Impact

This vulnerability could lead to unauthorized exposure of personal or sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations using affected Linux kernel versions may face compliance violations, potential fines, and reputational damage due to data leaks.

Mitigation Strategies

Immediately update your Linux kernel to a patched version that includes the fix for CVE-2026-98711. If updating is not possible, consider disabling the cw1200 WiFi driver if not in use. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart