CVE-2026-90408: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix overreads in ath12kwmiprocesscsaswitchcountevent()
There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the numvdevs field is taken directly from firmware and used as a loop bound over the vdevids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read.
Add a TLV policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath12kwmitlvdatalen() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath12kwmiprocesscsaswitchcountevent() to bound numvdevs before the loop.
Compile tested only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces the minimum length of the fixed-size event struct.
- Compensating control
Add ath12k_wmi_tlv_data_len() to recover the parsed TLV payload length from the header preceding its data pointer, and use it in ath12k_wmi_process_csa_switch_count_event() to bound the firmware-provided num_vdevs before looping over vdev_ids.
Event History
Frequently Asked Questions
What conditions are required for this issue to be triggered?
The affected ath12k code must process a WMI PDEV CSA switch count status event from firmware. Exploitation depends on firmware providing an event with an undersized TLV payload or a num_vdevs value that exceeds the space available for the vdev_ids array.
What is the practical impact of malformed firmware event data?
The event-processing loop can read beyond the TLV payload, resulting in an out-of-bounds read. The missing policy entry can also allow parsing of an event shorter than the fixed-size event structure.
How can I determine whether a fix is present?
Check whether the kernel includes the changes that add a TLV policy for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and bound num_vdevs using ath12k_wmi_tlv_data_len() in ath12k_wmi_process_csa_switch_count_event(). The provided stable references identify fixes at bf97c9d5123859a07848462539153176db029f3a and 878654eb78c6aa0ff585baf1376567c775ca28ec.