Cloudanix VulnDB

CVE-2026-98348

High · 7.1

CVSS

7.1

EPSS

0.3%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain older wireless network drivers can let nearby attackers send a bad network response that crashes the device or leaks a small amount of memory contents.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Integer wrap-around during subtraction of frame length from the 30-byte association response prefix causes a short frame to be treated as nearly 64 KiB, leading to an out-of-bounds read in libipw_parse_info_param after only a 24-byte 802.11 header check.

Why it matters to the business

Wireless devices using legacy ipw2100 or ipw2200 drivers may suffer crashes, denial of service, or limited information disclosure when receiving crafted management frames on the local network segment.

How an attack unfolds

An attacker within radio range transmits a malformed 802.11 association response shorter than the fixed fields; the receive path calls libipw_handle_assoc_resp which performs the wrapping length calculation and then reads past the actual buffer while parsing information elements.

How to fix it

Apply the upstream kernel commit that adds an early length check rejecting association responses shorter than the fixed 30-byte prefix before any field access or parsing occurs.

How to confirm the fix worked

Confirm the patch is present by inspecting libipw_handle_assoc_resp for the new minimum-length guard; test with the published KUnit case under KASAN; verify no short-frame parsing occurs on affected drivers.

Typical attack path

  1. Obtain wireless proximity to the target device
  2. Craft and transmit an 802.11 association response frame shorter than 30 bytes after the header
  3. Trigger libipw_handle_assoc_resp via the ipw2100 or ipw2200 management receive path
  4. Induce length wrap-around and subsequent out-of-bounds memory read

How to detect it

Review wireless management frame logs and kernel oops/panic records for unusually short association responses; examine crash dumps showing reads beyond the end of received 802.11 buffers in the libipw path.

What your security team should do

  • Identify systems still using ipw2100 or ipw2200 wireless hardware and prioritize kernel updates
  • Disable these legacy drivers if modern alternatives are available
  • Monitor for new kernel releases containing the length-check fix
  • Apply network segmentation to reduce exposure of legacy wireless clients

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipw_handle_assoc_resp() reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats->len - sizeof(*frame) stats->len is a u16 and sizeof() has type size_t, so the subtraction is evaluated as size_t and wraps instead of going negative. Truncating that to the u16 length parameter of libipw_parse_info_param() turns a frame shorter than the fixed fields into a length near 64 KiB, and the parser then reads past the receive buffer. Both the ipw2100 and ipw2200 management receive paths reach this function having established only that the frame carries the generic 24-byte three-address header. Reject the frame before any fixed field is touched. Found by an AI-assisted review of length arithmetic in management frame parsers. Verified with a KUnit case under Generic KASAN on arm64 under QEMU; I do not have the hardware, so it is not tested on a real device.

Affected packages

Ecosystem Package Introduced Fixed