CVE-2026-98711
Description
A flaw was found in the Linux kernel's cw1200 wireless network driver. During data transmission, the driver pads transfer sizes to meet hardware alignment requirements without reserving sufficient space in the frame buffer. This causes the driver to read beyond the buffer boundaries and transmit adjacent kernel memory across the bus. Consequently, a rogue or compromised hardware device can capture sensitive kernel heap data, leading to information disclosure.
Statement
The cw1200 TX path can read beyond the end of a frame buffer because the bus transfer length is rounded up for alignment without reserving matching skb tailroom. On SDIO systems this can expose up to 511 bytes of stale kernel heap data per transmitted frame to a malicious or compromised wireless device. Repeated transmissions may allow the device to collect a substantial amount of kernel memory, although the attacker cannot directly select which heap bytes appear in the padding. For the CVSS the PR:N value is used because no authenticated host privilege is required after the attacker controls the attached device. The attack vector is AV:P because the leaked padding is delivered to the directly attached SDIO or SPI device and is not transmitted to a remote WiFi peer. Impact is an information disclosure with no supported write primitive, kernel crash, or privilege escalation path.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.6 | N/A | N/A |
| Attack Vector | Physical | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
