CVE-2026-90407: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix overreads in ath11kwmiprocesscsaswitchcountevent()
There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the numvdevs field is taken directly from firmware and used as a loop bound over the vdevids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read.
Add a TLV policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath11kwmitlvdatalen() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath11kwmiprocesscsaswitchcountevent() to bound numvdevs before the loop.
Compile tested only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ath11k_wmi_process_csa_switch_count_event(), add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT to enforce the fixed-size event struct's minimum length, add ath11k_wmi_tlv_data_len() to recover the parsed TLV payload length, and use that length to bound num_vdevs before iterating over vdev_ids.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue is in the Linux kernel's ath11k Wi-Fi driver, specifically while handling the PDEV CSA switch count status event. Systems not using that driver or not processing this event are not implicated by the provided information.
What input condition triggers the out-of-bounds read risk?
The driver can process an event without enforcing the minimum fixed-structure length, and it uses the firmware-provided num_vdevs value as a loop bound without confirming that the vdev_ids array fits in the TLV payload. A malformed or truncated event payload can therefore cause reads beyond the available data.