CVE-2026-98711: Linux Kernel cw1200 Information Disclosure

CVE-2026-98711 Overview

CVE-2026-98711 is an out-of-bounds read vulnerability in the Linux kernel cw1200 Wi-Fi driver. The TX path in cw1200_data_write() rounds the transfer size up to the bus alignment using align_size(), which can add up to 511 bytes for SDIO transfers. The frame buffer has no reserved tailroom for this padding, so the bus transfer reads past the end of the frame and sends stale kernel heap data to the device. A malicious or compromised cw1200 Wi-Fi device can collect up to 511 bytes of adjacent kernel heap memory per transmitted frame, leaking sensitive data from the host system.

Critical Impact
A rogue cw1200 Wi-Fi device can harvest up to 511 bytes of kernel heap data per TX frame, exposing kernel memory contents to an untrusted hardware peripheral.

Affected Products

Linux kernel versions containing the cw1200 Wi-Fi driver prior to the referenced stable patches
Systems using the ST-Ericsson CW1200 Wi-Fi chipset over SDIO or SPI bus
Embedded and IoT platforms that integrate the cw1200 driver

Discovery Timeline

2026-10-18 - CVE-2026-98711 published to NVD
2026-10-21 - Last updated in NVD database

The vulnerability was discovered by Atuin, an Automated Vulnerability Discovery Engine, as noted in the kernel commit message.

Technical Details for CVE-2026-98711

Vulnerability Analysis

The cw1200 driver supports Wi-Fi operation over SDIO and SPI buses. Both buses require transfer sizes aligned to a bus-specific boundary. The TX path computes the padded transfer length via the align_size() bus callback but transmits that padded length directly from the socket buffer (skb) without reserving tailroom for the extra bytes. As a result, cw1200_data_write() reads beyond the valid frame content.

The out-of-bounds read overlaps with whatever kernel heap memory follows the frame data. These bytes are then clocked out to the Wi-Fi device over the bus. Because the Wireless Service Module (WSM) header already carries the real frame length, the device never acts on the trailing bytes, but a malicious or tampered device can capture and exfiltrate them. The RX path is unaffected because it allocates the socket buffer with the aligned length before the read occurs.

Root Cause

The root cause is a mismatch between the frame buffer allocation and the bus-aligned transfer length. The TX code path treats the padded length as the transfer size without ensuring the skb has sufficient tailroom. Uninitialized adjacent heap memory is therefore included in the DMA or programmed I/O transaction to the device.

Attack Vector

Exploitation requires a device-side attacker — either a malicious or compromised cw1200 Wi-Fi chip, a modified firmware image, or a hardware interposer on the SDIO or SPI bus. The adversary observes the padded transfer bytes delivered by the host and reassembles kernel heap contents across many TX frames. This is a local information disclosure that leaks memory from host kernel space to an untrusted peripheral.

No verified public exploitation code is available. The vulnerability is described in prose above based on the upstream kernel commit message referenced in the NVD entry.

Detection Methods for CVE-2026-98711

Indicators of Compromise

Unexpected or unauthorized firmware images loaded on cw1200-based Wi-Fi hardware
Hardware tampering indicators on embedded devices using SDIO or SPI Wi-Fi modules
Kernel versions on affected systems that do not include commits 678c8f4, 71f693a, 7c16117, b0e97bd, or b66539a

Detection Strategies

Inventory Linux systems running kernels with the cw1200 driver enabled and compare against patched stable branches
Audit kernel configurations (CONFIG_CW1200) across embedded fleets to identify exposed devices
Validate firmware integrity of cw1200 Wi-Fi modules through signed firmware verification where supported

Monitoring Recommendations

Track kernel package versions through configuration management and alert on hosts missing the fix
Monitor dmesg and kernel audit logs for anomalous cw1200 driver errors or firmware load events
Correlate Wi-Fi hardware replacement or firmware update events with change-management records

How to Mitigate CVE-2026-98711

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD advisory to all affected Linux systems
Rebuild and redeploy custom kernels for embedded or IoT devices that ship the cw1200 driver
Restrict physical access to hardware using the cw1200 chipset to prevent bus-level tampering

Patch Information

The fix computes the exact padding length using the bus align_size() callback, ensures the queued TX skb has tailroom for the padding, and zeroes the padding bytes before the bus transfer. This eliminates the disclosure of adjacent heap memory while preserving frame contents and transfer sizes. Patches are available in the following stable kernel commits:

Workarounds

Blacklist the cw1200 kernel module on systems that do not require this Wi-Fi hardware
Disable the Wi-Fi interface or replace cw1200-based modules with unaffected hardware where feasible
Isolate affected embedded devices on segmented networks until kernels can be patched