CVE-2026-90408 (GCVE-0-2026-90408)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:55
VLAI
Title
wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < bf97c9d5123859a07848462539153176db029f3a (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 878654eb78c6aa0ff585baf1376567c775ca28ec (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf97c9d5123859a07848462539153176db029f3a",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "878654eb78c6aa0ff585baf1376567c775ca28ec",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()\n\nThere is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so\nthe parse infrastructure does not enforce a minimum length for the event\nstruct. Additionally, the num_vdevs field is taken directly from firmware\nand used as a loop bound over the vdev_ids array without checking that it\nfits within the TLV payload. Either condition can cause an out-of-bounds\nread.\n\nAdd a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so\nthe parse infrastructure enforces a minimum length for the fixed-size event\nstruct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload\nlength of a parsed TLV from the header preceding its data pointer. Use it\nin ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before\nthe loop.\n\nCompile tested only."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Firmware supplies the malformed bytes in WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID (num_vdevs and the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT TLV length) on CE2 \u2192 ath12k_ce_recv_process_cb \u2192 ath12k_htc_rx_completion_handler \u2192 ath12k_wmi_op_rx; 802.11 CSA IEs do not carry those fields, so this is the host-firmware HTC path, not an over-the-air frame parse.\nAC:L - Pre-fix ath12k_wmi_tlv_policies had no min_len for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, and ath12k_wmi_process_csa_switch_count_event() used firmware le32 num_vdevs as the vdev_ids[] loop bound with no TLV-length check, so a short event TLV or oversized num_vdevs overreads on every such event with no race.\nPR:N - ath12k_wmi_op_rx() dispatches WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID from the WMI HTC endpoint (ath12k_connect_pdev_htc_service) with no host uid, capability, or authentication check; the Wi-Fi firmware is the sole source of the event.\nUI:N - ath12k_wmi_process_csa_switch_count_event() reads vdev_ids[i] in the num_vdevs loop before the conf-\u003ecsa_active continue, so a crafted CSA-count WMI event overreads even when the victim never started a channel switch; no mount or other user action is required.\nS:U - The vdev_ids[] overread and any oops remain inside the host kernel ath12k/mac80211 authority; the bug does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Firmware-chosen num_vdevs is an unbounded u32 loop over the WMI_TAG_ARRAY_UINT32 vdev_ids payload (policy min_len 0), so the handler can read far past the CE WMI skb (~2KB); unknown vdev_ids[i] values are also printed by ath12k_warn(), which is an unbounded kernel overread, not a few bytes.\nI:N - The loop only loads vdev_ids[i] and looks them up with ath12k_mac_get_arvif_by_vdev_id(); it does not write out of bounds, and ieee80211_csa_finish() runs only for an already-valid in-CSA arvif rather than as a write primitive from the overread.\nA:H - A huge num_vdevs walks vdev_ids[] off the WMI skb while holding rcu_read_lock(), which can oops/panic on unmapped or KASAN-redzoned heap past the CE buffer and can stall RCU for a 32-bit iteration count, a full kernel availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:55:13.303Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf97c9d5123859a07848462539153176db029f3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/878654eb78c6aa0ff585baf1376567c775ca28ec"
        }
      ],
      "title": "wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90408",
    "datePublished": "2026-09-17T16:09:36.089Z",
    "dateReserved": "2026-09-11T19:38:34.812Z",
    "dateUpdated": "2026-09-18T17:55:13.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90408",
      "date": "2026-09-29",
      "epss": "0.00175",
      "percentile": "0.06222"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath12k/wmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bf97c9d5123859a07848462539153176db029f3a",
                    "status": "affected",
                    "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "878654eb78c6aa0ff585baf1376567c775ca28ec",
                    "status": "affected",
                    "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath12k/wmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()\n\nThere is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so\nthe parse infrastructure does not enforce a minimum length for the event\nstruct. Additionally, the num_vdevs field is taken directly from firmware\nand used as a loop bound over the vdev_ids array without checking that it\nfits within the TLV payload. Either condition can cause an out-of-bounds\nread.\n\nAdd a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so\nthe parse infrastructure enforces a minimum length for the fixed-size event\nstruct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload\nlength of a parsed TLV from the header preceding its data pointer. Use it\nin ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before\nthe loop.\n\nCompile tested only."
          }
        ],
        "id": "CVE-2026-90408",
        "lastModified": "2026-09-18T18:17:57.940",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:40.700",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/878654eb78c6aa0ff585baf1376567c775ca28ec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf97c9d5123859a07848462539153176db029f3a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:28:32Z",
      "cve": "CVE-2026-90408",
      "id": "CVE-2026-90408",
      "initial_release_date": "2026-09-22T16:28:32Z",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90408",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90408.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.