CVE-2026-90361: wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix leak in ath11kservicereadyextevent()
Currently, during ath11kservicereadyextevent() processing, svcrdyext.macphycaps can be allocated during TLV parsing. This is a temporary allocation that is freed on the success path, but not on the error path. If parsing succeeds far enough to allocate macphycaps and then fails on a later TLV, the allocation leaks. So free the allocation on the error path.
Compile tested only.
Event History
Frequently Asked Questions
What conditions are required for the leak to occur?
TLV parsing in ath11k_service_ready_ext_event() must allocate svc_rdy_ext.mac_phy_caps successfully and then fail while processing a later TLV. The success path already frees this temporary allocation; only the subsequent error path leaks it.
What is the practical impact described for affected systems?
The described impact is a memory leak of the temporary mac_phy_caps allocation when the specified parsing error path is reached. No other impact, exploit prerequisites, or affected configuration details are provided.
Is there a workaround if the fix cannot be applied immediately?
No workaround is provided. The described remediation is to free the allocation on the error path.