CVE-2026-90408: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix overreads in ath12kwmiprocesscsaswitchcountevent()
There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the numvdevs field is taken directly from firmware and used as a loop bound over the vdevids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read.
Add a TLV policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath12kwmitlvdatalen() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath12kwmiprocesscsaswitchcountevent() to bound numvdevs before the loop.
Compile tested only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel ath12k code so the TLV parse infrastructure includes a policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, and use a helper ath12k_wmi_tlv_data_len() to recover the payload length. In ath12k_wmi_process_csa_switch_count_event(), bound num_vdevs (taken from firmware) before using it as the loop bound over the vdev_ids array, ensuring it fits within the TLV payload length when reading from the parsed TLV header/data pointer. Ensure the parse infrastructure does not rely on missing minimum length enforcement for this event payload.
Linux kernel (ath12k WMI) Fix overreads in ath12k_wmi_process_csa_switch_count_event() = Implement TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and add ath12k_wmi_tlv_data_len() to recover payload length; bound num_vdevs before parsing TLV payload and ensure it fits within TLV length
Event History
Frequently Asked Questions
What conditions are required for this issue to be triggered?
The affected ath12k code must process a WMI PDEV CSA switch count status event from firmware. Exploitation depends on firmware providing an event with an undersized TLV payload or a num_vdevs value that exceeds the space available for the vdev_ids array.
What is the practical impact of malformed firmware event data?
The event-processing loop can read beyond the TLV payload, resulting in an out-of-bounds read. The missing policy entry can also allow parsing of an event shorter than the fixed-size event structure.
How can I determine whether a fix is present?
Check whether the kernel includes the changes that add a TLV policy for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and bound num_vdevs using ath12k_wmi_tlv_data_len() in ath12k_wmi_process_csa_switch_count_event(). The provided stable references identify fixes at bf97c9d5123859a07848462539153176db029f3a and 878654eb78c6aa0ff585baf1376567c775ca28ec.