CVE-2026-90408: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix overreads in ath12kwmiprocesscsaswitchcountevent()

There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the numvdevs field is taken directly from firmware and used as a loop bound over the vdevids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read.

Add a TLV policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath12kwmitlvdatalen() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath12kwmiprocesscsaswitchcountevent() to bound numvdevs before the loop.

Compile tested only.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Update the Linux kernel ath12k code so the TLV parse infrastructure includes a policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, and use a helper ath12k_wmi_tlv_data_len() to recover the payload length. In ath12k_wmi_process_csa_switch_count_event(), bound num_vdevs (taken from firmware) before using it as the loop bound over the vdev_ids array, ensuring it fits within the TLV payload length when reading from the parsed TLV header/data pointer. Ensure the parse infrastructure does not rely on missing minimum length enforcement for this event payload.

    Linux kernel (ath12k WMI) Fix overreads in ath12k_wmi_process_csa_switch_count_event() = Implement TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and add ath12k_wmi_tlv_data_len() to recover payload length; bound num_vdevs before parsing TLV payload and ensure it fits within TLV length

Event History

Sep 17, 2026
CVE Published
via MITRE·04:09 PM
Data Sourced
via MITRE·04:09 PM
Description

Frequently Asked Questions

1

What conditions are required for this issue to be triggered?

The affected ath12k code must process a WMI PDEV CSA switch count status event from firmware. Exploitation depends on firmware providing an event with an undersized TLV payload or a num_vdevs value that exceeds the space available for the vdev_ids array.

2

What is the practical impact of malformed firmware event data?

The event-processing loop can read beyond the TLV payload, resulting in an out-of-bounds read. The missing policy entry can also allow parsing of an event shorter than the fixed-size event structure.

3

How can I determine whether a fix is present?

Check whether the kernel includes the changes that add a TLV policy for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and bound num_vdevs using ath12k_wmi_tlv_data_len() in ath12k_wmi_process_csa_switch_count_event(). The provided stable references identify fixes at bf97c9d5123859a07848462539153176db029f3a and 878654eb78c6aa0ff585baf1376567c775ca28ec.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203