CVE-2026-90407 (GCVE-0-2026-90407)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:55
VLAI
Title
wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d5c65159f2895379e11ca13f62feabe93278985d , < f760b7d7e43584d2fa9bffcec1a04e502609f827 (git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce (git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < 0364926fb4bfb5b798e5fe2785b3023b4f767327 (git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < 5de2b8c53714ad58f2fda118cd29ebbe31b38665 (git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < 208d7fdb85976a737a715b81d54efaff6703880c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f760b7d7e43584d2fa9bffcec1a04e502609f827",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "0364926fb4bfb5b798e5fe2785b3023b4f767327",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "5de2b8c53714ad58f2fda118cd29ebbe31b38665",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "208d7fdb85976a737a715b81d54efaff6703880c",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()\n\nThere is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so\nthe parse infrastructure does not enforce a minimum length for the event\nstruct. Additionally, the num_vdevs field is taken directly from firmware\nand used as a loop bound over the vdev_ids array without checking that it\nfits within the TLV payload. Either condition can cause an out-of-bounds\nread.\n\nAdd a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so\nthe parse infrastructure enforces a minimum length for the fixed-size event\nstruct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload\nlength of a parsed TLV from the header preceding its data pointer. Use it\nin ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before\nthe loop.\n\nCompile tested only."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed bytes are firmware WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID TLVs on CE2 (ath11k_ce_recv_process_cb \u2192 ath11k_htc_rx_completion_handler \u2192 ath11k_wmi_tlv_op_rx). num_vdevs and the event/ARRAY_UINT32 lengths are built by firmware, not taken from an 802.11 CSA IE, so this is a host-firmware HTC path, not WiFi frame injection.\nAC:L - wmi_tlv_policies had no min_len for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, and ath11k_wmi_process_csa_switch_count_event() used ev-\u003enum_vdevs as the vdev_ids[] bound with no compare to the ARRAY_UINT32 TLV length. Firmware setting current_switch_count=0 and an oversized num_vdevs makes the overread deterministic, with no race.\nPR:N - ath11k_wmi_tlv_op_rx() dispatches WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID from the WMI HTC rx callback with no host uid, capability, or authentication check; the device firmware is the sole source of the event struct and vdev_ids array.\nUI:N - Firmware can send WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID unsolicited on the WMI RX path; the overread of ev-\u003ecurrent_switch_count/num_vdevs and vdev_ids[i] runs before the csa_active check and does not require the victim to start a channel switch, mount media, or open a file.\nS:U - The out-of-bounds loads of ev fields and vdev_ids[] stay inside the host kernel ath11k WMI parser and the CE RX skb heap; they do not cross a VM, IOMMU, or other separate security authority.\nC:H - ev-\u003enum_vdevs is a firmware u32 used as an unbounded index over vdev_ids[], so a count past the ARRAY_UINT32 TLV reads kernel heap beyond the WMI skb; unknown ids are also printed by ath11k_warn(\"Recvd csa status for unknown vdev %d\"). That is not a few-byte leak.\nI:N - The loop only reads vdev_ids[i] into ath11k_mac_get_arvif_by_vdev_id(); it never writes through the overread pointer. ieee80211_csa_finish() runs only if a looked-up vif already has csa_active, which is not an OOB write or hijack primitive from the overread.\nA:H - A firmware-chosen num_vdevs that walks vdev_ids[] past the CE RX skb can load from unmapped heap and oops/panic in ath11k_wmi_process_csa_switch_count_event(), which is a full kernel availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:55:12.082Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f760b7d7e43584d2fa9bffcec1a04e502609f827"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/0364926fb4bfb5b798e5fe2785b3023b4f767327"
        },
        {
          "url": "https://git.kernel.org/stable/c/5de2b8c53714ad58f2fda118cd29ebbe31b38665"
        },
        {
          "url": "https://git.kernel.org/stable/c/208d7fdb85976a737a715b81d54efaff6703880c"
        }
      ],
      "title": "wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90407",
    "datePublished": "2026-09-17T16:09:35.420Z",
    "dateReserved": "2026-09-11T19:38:34.812Z",
    "dateUpdated": "2026-09-18T17:55:12.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90407",
      "date": "2026-09-29",
      "epss": "0.0019",
      "percentile": "0.07797"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath11k/wmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f760b7d7e43584d2fa9bffcec1a04e502609f827",
                    "status": "affected",
                    "version": "d5c65159f2895379e11ca13f62feabe93278985d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce",
                    "status": "affected",
                    "version": "d5c65159f2895379e11ca13f62feabe93278985d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0364926fb4bfb5b798e5fe2785b3023b4f767327",
                    "status": "affected",
                    "version": "d5c65159f2895379e11ca13f62feabe93278985d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5de2b8c53714ad58f2fda118cd29ebbe31b38665",
                    "status": "affected",
                    "version": "d5c65159f2895379e11ca13f62feabe93278985d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "208d7fdb85976a737a715b81d54efaff6703880c",
                    "status": "affected",
                    "version": "d5c65159f2895379e11ca13f62feabe93278985d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath11k/wmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.6"
                  },
                  {
                    "lessThan": "5.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()\n\nThere is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so\nthe parse infrastructure does not enforce a minimum length for the event\nstruct. Additionally, the num_vdevs field is taken directly from firmware\nand used as a loop bound over the vdev_ids array without checking that it\nfits within the TLV payload. Either condition can cause an out-of-bounds\nread.\n\nAdd a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so\nthe parse infrastructure enforces a minimum length for the fixed-size event\nstruct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload\nlength of a parsed TLV from the header preceding its data pointer. Use it\nin ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before\nthe loop.\n\nCompile tested only."
          }
        ],
        "id": "CVE-2026-90407",
        "lastModified": "2026-09-18T18:17:57.790",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:40.573",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0364926fb4bfb5b798e5fe2785b3023b4f767327"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/208d7fdb85976a737a715b81d54efaff6703880c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5de2b8c53714ad58f2fda118cd29ebbe31b38665"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f760b7d7e43584d2fa9bffcec1a04e502609f827"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-23T13:22:39+00:00",
      "cve": "CVE-2026-90407",
      "id": "CVE-2026-90407",
      "initial_release_date": "2026-09-17T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90407.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:28:34Z",
      "cve": "CVE-2026-90407",
      "id": "CVE-2026-90407",
      "initial_release_date": "2026-09-18T00:16:43Z",
      "product_status:known_affected": "126",
      "product_status:known_not_affected": "221",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90407",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90407.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.