CVE-2026-90407
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, the ath11k Wi-Fi driver does not enforce a minimum length for the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT structure, and the firmware-supplied num_vdevs field is used as a loop bound without validation. This can cause an out-of-bounds read. The fix adds a TLV policy entry and a helper to bound num_vdevs.
Risk Assessment
An out-of-bounds read can lead to kernel crashes or memory information disclosure. This affects systems with ath11k Wi-Fi cards, mainly laptops and embedded devices.
Recommendation
Update the Linux kernel to a version containing the ath11k fix. If updating is not possible, consider restricting use of ath11k cards in high-risk environments.
Other vulnerabilities in Linux kernel (ath11k)
See all- CVE-2026-98307Unknown
A memory leak was found in the Linux kernel's ath11k Wi-Fi driver. When the firmware crashes, ath11k_mac_peer_cleanup_all() failed to free arsta->rx_stats and tx_stats resources, causing kernel memory leaks (kmemleak). The fix extracts arsta cleanup into a new ath11k_mac_station_cleanup() function and calls it from both locations.
- CVE-2022-49130Medium
In the Linux kernel, the ath11k driver for Qualcomm Wi-Fi cards has a vulnerability causing a system crash during 'rmmod ath11k_pci' when amss.bin is missing. The issue is due to using mhi_async_power_up(), which does not check errors, instead of the safer mhi_sync_power_up().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS