Out-of-bounds read in Linux kernel - CVE-2026-98711

Vulnerability identifier: #VU157051

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98711

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker with physical access to system to disclose kernel heap data to a malicious wireless device.

The vulnerability exists due to an out-of-bounds read in the Linux kernel cw1200 wireless driver's transmit path when sending frames with bus alignment padding from buffers without sufficient tailroom. An attacker with physical access to system can use a malicious device to collect bytes read past the end of the frame buffer, exposing up to 511 bytes of kernel heap data per transmitted frame over SDIO.

Linux kernel
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1

• https://git.kernel.org/stable/c/678c8f4ba285649d5418a858d5d4f30c728a54ad
• https://git.kernel.org/stable/c/71f693a0ecccf36532dd2790f7969da6c71d5d23
• https://git.kernel.org/stable/c/7c1611780823b76219cb1478db53dfd890c4a9a2
• https://git.kernel.org/stable/c/b0e97bd40e0c2cb1a3530ef8f6250aacf3224515
• https://git.kernel.org/stable/c/b66539a4dab128fafaad736b53ce15c19d14d561

• Out-of-bounds read in Linux kernel st cw1200 driver
• SUSE update for the Linux Kernel