CVE-2026-90407: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix overreads in ath11kwmiprocesscsaswitchcountevent()
There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the numvdevs field is taken directly from firmware and used as a loop bound over the vdevids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read.
Add a TLV policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath11kwmitlvdatalen() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath11kwmiprocesscsaswitchcountevent() to bound numvdevs before the loop.
Compile tested only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (wifi: ath11k)to a version that resolves this vulnerability.Fixed in resolved - Configuration
Add the missing TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parser recognizes it (there was 'no policy entry' for this tag).
Linux kernel ath11k Wi-Fi driver (wifi: ath11k) WMI TLV parsing policy entry = Add policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT - Configuration
Implement and use a helper function ath11k_wmi_tlv_data_len() to recover the parsed TLV payload length for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT processing.
Linux kernel ath11k Wi-Fi driver (ath11k WMI) ath11k_wmi_tlv_data_len() helper usage = Use ath11k_wmi_tlv_data_len() to recover payload length - Configuration
In ath11k_wmi_process_csa_switch_count_event(), ensure num_vdevs (taken directly from firmware) is bounded so it does not overrun the TLV payload; specifically, bound num_vdevs before parsing/looping over vdev_ids based on the available length recovered from the TLV.
Linux kernel ath11k Wi-Fi driver (ath11k_wmi_process_csa_switch_count_event()) Loop bound validation for num_vdevs = Bound num_vdevs before using it as loop bound over vdev_ids
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue is in the Linux kernel's ath11k Wi-Fi driver, specifically while handling the PDEV CSA switch count status event. Systems not using that driver or not processing this event are not implicated by the provided information.
What input condition triggers the out-of-bounds read risk?
The driver can process an event without enforcing the minimum fixed-structure length, and it uses the firmware-provided num_vdevs value as a loop bound without confirming that the vdev_ids array fits in the TLV payload. A malformed or truncated event payload can therefore cause reads beyond the available data.