CVE-2026-98711: wifi: cw1200: fix TX padding OOB read leaking heap data to device
In the Linux kernel, the following vulnerability has been resolved:
wifi: cw1200: fix TX padding OOB read leaking heap data to device
The TX path rounds the transfer size up to the bus alignment (alignsize(), up to 511 bytes for SDIO, 1 byte for SPI) but sends the padded length straight from the frame buffer, which has no room reserved for the padding. cw1200datawrite() therefore reads past the end of the frame and the bus transfer carries those bytes to the device. A bogus device can collect up to 511 bytes of kernel heap data per TX frame.
The RX path does not have this problem: it allocates the skb with the aligned length (alloclen) before reading.
Compute the exact padding with the bus alignsize() callback, make sure queued TX frames have tailroom for it, and zero the padding bytes before the transfer so nothing past the frame is exposed.
This is not expected to change driver behavior on most cases: frame contents and transfer sizes are unchanged, only the content of the padding bytes (previously undefined stale memory, now zero), which the device never reads since the WSM header carries the real frame length. The skb expansion can only fail under memory exhaustion, in which case the frame is dropped like on the existing error paths of cw1200tx().
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Compensating control
In the Linux kernel cw1200 TX path, compute the exact padding using the bus align_size() callback, ensure queued TX frames have tailroom for the padding, and zero the padding bytes before transfer so bytes past the frame are not exposed to the device.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel cw1200 Wi-Fi driver are exposed when transmitting frames through the affected TX path. The potential leakage is largest on SDIO, where alignment padding can be up to 511 bytes per transmitted frame; SPI alignment is 1 byte.
What does an attacker need to exploit the leak?
A malicious or bogus Wi-Fi device capable of receiving transfers from the cw1200 driver can collect the padding bytes sent after TX frames. Those bytes may contain stale kernel heap data because the original frame buffer did not reserve space for the aligned transfer length.
Does the vulnerability affect received traffic?
No. The described RX path allocates the skb using the aligned length before reading, so it does not perform the out-of-bounds read described for TX.
What changes after applying the fix?
The driver ensures queued TX frames have tailroom for required alignment padding and zeroes that padding before transfer. Frame contents and transfer sizes remain unchanged; only previously undefined padding bytes become zero.