FKIE_CVE-2026-98711

Vulnerability from fkie_nvd - Published: 2026-10-18 16:17 - Updated: 2026-10-30 13:21
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment (align_size(), up to 511 bytes for SDIO, 1 byte for SPI) but sends the padded length straight from the frame buffer, which has no room reserved for the padding. cw1200_data_write() therefore reads past the end of the frame and the bus transfer carries those bytes to the device. A bogus device can collect up to 511 bytes of kernel heap data per TX frame. The RX path does not have this problem: it allocates the skb with the aligned length (alloc_len) before reading. Compute the exact padding with the bus align_size() callback, make sure queued TX frames have tailroom for it, and zero the padding bytes before the transfer so nothing past the frame is exposed. This is not expected to change driver behavior on most cases: frame contents and transfer sizes are unchanged, only the content of the padding bytes (previously undefined stale memory, now zero), which the device never reads since the WSM header carries the real frame length. The skb expansion can only fail under memory exhaustion, in which case the frame is dropped like on the existing error paths of cw1200_tx(). Discovered by Atuin - Automated Vulnerability Discovery Engine.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5897945635aa5413595bf696127493be96c08e2d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/678c8f4ba285649d5418a858d5d4f30c728a54ad
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/71f693a0ecccf36532dd2790f7969da6c71d5d23
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7c1611780823b76219cb1478db53dfd890c4a9a2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8e8e4d0b15f174d964a48b1c54dc8828e5ae87c5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a7eae7547ae1443bfbca2cb90d3ef5e501d6445c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b0e97bd40e0c2cb1a3530ef8f6250aacf3224515
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b66539a4dab128fafaad736b53ce15c19d14d561
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/st/cw1200/bh.c",
            "drivers/net/wireless/st/cw1200/txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8e8e4d0b15f174d964a48b1c54dc8828e5ae87c5",
              "status": "affected",
              "version": "a910e4a94f6923c8c988565525f017f687bf7205",
              "versionType": "git"
            },
            {
              "lessThan": "a7eae7547ae1443bfbca2cb90d3ef5e501d6445c",
              "status": "affected",
              "version": "a910e4a94f6923c8c988565525f017f687bf7205",
              "versionType": "git"
            },
            {
              "lessThan": "5897945635aa5413595bf696127493be96c08e2d",
              "status": "affected",
              "version": "a910e4a94f6923c8c988565525f017f687bf7205",
              "versionType": "git"
            },
            {
              "lessThan": "b66539a4dab128fafaad736b53ce15c19d14d561",
              "status": "affected",
              "version": "a910e4a94f6923c8c988565525f017f687bf7205",
              "versionType": "git"
            },
            {
              "lessThan": "71f693a0ecccf36532dd2790f7969da6c71d5d23",
              "status": "affected",
              "version": "a910e4a94f6923c8c988565525f017f687bf7205",
              "versionType": "git"
            },
            {
              "lessThan": "b0e97bd40e0c2cb1a3530ef8f6250aacf3224515",
              "status": "affected",
              "version": "a910e4a94f6923c8c988565525f017f687bf7205",
              "versionType": "git"
            },
            {
              "lessThan": "678c8f4ba285649d5418a858d5d4f30c728a54ad",
              "status": "affected",
              "version": "a910e4a94f6923c8c988565525f017f687bf7205",
              "versionType": "git"
            },
            {
              "lessThan": "7c1611780823b76219cb1478db53dfd890c4a9a2",
              "status": "affected",
              "version": "a910e4a94f6923c8c988565525f017f687bf7205",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/st/cw1200/bh.c",
            "drivers/net/wireless/st/cw1200/txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cw1200: fix TX padding OOB read leaking heap data to device\n\nThe TX path rounds the transfer size up to the bus alignment\n(align_size(), up to 511 bytes for SDIO, 1 byte for SPI) but sends\nthe padded length straight from the frame buffer, which has no room\nreserved for the padding.  cw1200_data_write() therefore reads past\nthe end of the frame and the bus transfer carries those bytes to the\ndevice.  A bogus device can collect up to 511 bytes of kernel heap\ndata per TX frame.\n\nThe RX path does not have this problem: it allocates the skb with\nthe aligned length (alloc_len) before reading.\n\nCompute the exact padding with the bus align_size() callback, make\nsure queued TX frames have tailroom for it, and zero the padding\nbytes before the transfer so nothing past the frame is exposed.\n\nThis is not expected to change driver behavior on most cases: frame\ncontents and transfer sizes are unchanged, only the content of the\npadding bytes (previously undefined stale memory, now zero), which\nthe device never reads since the WSM header carries the real frame\nlength.  The skb expansion can only fail under memory exhaustion,\nin which case the frame is dropped like on the existing error paths\nof cw1200_tx().\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."
    }
  ],
  "id": "CVE-2026-98711",
  "lastModified": "2026-10-30T13:21:20.680",
  "metrics": {},
  "published": "2026-10-18T16:17:24.653",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5897945635aa5413595bf696127493be96c08e2d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/678c8f4ba285649d5418a858d5d4f30c728a54ad"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/71f693a0ecccf36532dd2790f7969da6c71d5d23"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7c1611780823b76219cb1478db53dfd890c4a9a2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8e8e4d0b15f174d964a48b1c54dc8828e5ae87c5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a7eae7547ae1443bfbca2cb90d3ef5e501d6445c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b0e97bd40e0c2cb1a3530ef8f6250aacf3224515"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b66539a4dab128fafaad736b53ce15c19d14d561"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.