SB20261022316 - Out-of-bounds read in Linux kernel st cw1200 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-98711)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to disclose kernel heap data to a malicious wireless device.

The vulnerability exists due to an out-of-bounds read in the Linux kernel cw1200 wireless driver's transmit path when sending frames with bus alignment padding from buffers without sufficient tailroom. An attacker with physical access to system can use a malicious device to collect bytes read past the end of the frame buffer, exposing up to 511 bytes of kernel heap data per transmitted frame over SDIO.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/678c8f4ba285649d5418a858d5d4f30c728a54ad
• https://git.kernel.org/stable/c/71f693a0ecccf36532dd2790f7969da6c71d5d23
• https://git.kernel.org/stable/c/7c1611780823b76219cb1478db53dfd890c4a9a2
• https://git.kernel.org/stable/c/b0e97bd40e0c2cb1a3530ef8f6250aacf3224515
• https://git.kernel.org/stable/c/b66539a4dab128fafaad736b53ce15c19d14d561