Out-of-bounds read in Linux kernel - CVE-2026-98348

Vulnerability details

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to unsigned length arithmetic wrapping in libipw_handle_assoc_resp() when processing association response frames shorter than the 30-byte fixed prefix. A remote attacker can send a truncated association response frame to trigger an out-of-bounds read.

The ipw2100 and ipw2200 management receive paths check only for the generic 24-byte three-address header before reaching this function. The wrapped length is truncated to a 16-bit value near 64 KiB and passed to libipw_parse_info_param(), which reads beyond the receive buffer.

Affected software

How to mitigate CVE-2026-98348

External References

• https://git.kernel.org/stable/c/14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb
• https://git.kernel.org/stable/c/400b89217058fac672134a0d4092c8493dadb8ad
• https://git.kernel.org/stable/c/46aa75291056b6dc5faaf956dffdb3e9662477b0
• https://git.kernel.org/stable/c/766268b429ae26d8ca599031fa962b0fe4673120
• https://git.kernel.org/stable/c/adb7118b7d2cfd7e8213c17d7d2829f353017754
• https://git.kernel.org/stable/c/af1b69be19c34e28c0ae54bee954b58cd076969a
• https://git.kernel.org/stable/c/d70bdb84cf1782039384c1ffa7a18b0303c286a7
• https://git.kernel.org/stable/c/e3025ecdb2057f866c09e059fc1466e81d6f243e

Related Security Bulletins

• Out-of-bounds read in Linux kernel intel ipw2x00 driver
• Debian update for linux