In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path… (CVE-2026-98711)

The Linux kernel cw1200 WiFi driver had a vulnerability where the TX path rounded the transfer size up to the bus alignment but sent the padded length directly from the frame buffer without reserved space for padding. This caused cw1200_data_write() to read past the end of the frame buffer, leaking up to 511 bytes of kernel heap data per TX frame to the device. The RX path was unaffected as it allocated the skb with aligned length before reading. The fix involves computing exact padding with the bus align_size() callback, ensuring queued TX frames have tailroom for padding, and zeroing the padding bytes before transfer to prevent leaking stale memory. The fix does not change driver behavior except that padding bytes are zeroed instead of containing stale data. The skb expansion can fail under memory exhaustion, dropping the frame as per existing error handling. The vulnerability was discovered by Atuin - Automated Vulnerability Discovery Engine.

A malicious or bogus device could collect up to 511 bytes of kernel heap data per transmitted frame, potentially leaking sensitive kernel memory contents. This could lead to information disclosure from kernel memory to the device. No indication of remote exploitation or broader impact is provided.

A fix has been implemented in the Linux kernel cw1200 driver to correctly compute and zero TX padding bytes, preventing out-of-bounds reads and data leakage. Users should apply the official kernel update containing this fix. No additional mitigation is indicated.