Live › vulnerability › CVE-2026-98711
Go to dashboardThe cw1200 Wi-Fi driver in the Linux kernel pads outgoing SDIO or SPI transfers past the end of the frame buffer, so up to 511 bytes of kernel heap memory per frame are sent to the wireless chip. The exposure is to the device itself, which a hostile or compromised wireless module could collect.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running a kernel with the cw1200 Wi-Fi driver, which drives ST-Ericsson CW1200 wireless chips over SDIO or SPI, are exposed. The leak goes to the wireless chip, so the concern is mainly embedded boards or devices with this hardware, not general servers or desktops.
No product ranges from the sources yet.
lsmod | grep cw1200 or whether cw1200_wlan_sdio or cw1200_wlan_spi modules exist for your kernel.echo 'blacklist cw1200_wlan_sdio' > /etc/modprobe.d/cw1200.conf.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: cw1200: fix TX padding OOB read leaking heap data to device
The TX path rounds the transfer size up to the bus alignment (align_size(), up to 511 bytes for SDIO, 1 byte for SPI) but sends the padded length straight from the frame buffer, which has no room reserved for the padding. cw1200_data_write() therefore reads past the end of the frame and the bus transfer carries those bytes to the device. A bogus device can collect up to 511 bytes of kernel heap data per TX frame.
The RX path does not have this problem: it allocates the skb with the aligned length (alloc_len) before reading.
Compute the exact padding with the bus align_size() callback, make sure queued TX frames have tailroom for it, and zero the padding bytes before the transfer so nothing past the frame is exposed.
This is not expected to change driver behavior on most cases: frame contents and transfer sizes are unchanged, only the content of the padding bytes (previously undefined stale memory, now zero), which the device never reads since the WSM header carries the real frame length. The skb expansion can only fail under memory exhaustion, in which case the frame is dropped like on the existing error paths of cw1200_tx().
Discovered by Atuin - Automated Vulnerability Discovery Engine.
This page as .md · .json · in your agent: get_signal("CVE-2026-98711")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.