CVE-2026-92496: wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: Avoid buffer overread in ath11kwmitlvoprx()
Currently, in ath11kwmitlvoprx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread.
Add an upfront length check before dereferencing skb->data as a wmicmdhdr. The check is placed before the traceath11kwmievent() call to preserve the existing trace semantics (tracing the full raw WMI event including the header), unlike the analogous ath12k fix which could use skbpulldata() directly.
Compile tested only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ath11k_wmi_tlv_op_rx(), add an upfront buffer length verification to ensure the firmware skb contains enough data to hold a wmi_cmd_hdr before dereferencing skb->data, and place the check before trace_ath11k_wmi_event() to prevent buffer overread.
Linux kernel ath11k driver (ath11k_wmi_tlv_op_rx) Add upfront length check before dereferencing skb->data = Check skb->len (or sufficient length) before accessing wmi_cmd_hdr; perform check before trace_ath11k_wmi_event()
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the ath11k Wi-Fi driver are the relevant population, because the affected receive path is ath11k_wmi_tlv_op_rx().
What condition triggers the overread?
The issue occurs when the driver processes a firmware buffer that is too short to contain a WMI command header. The vulnerable code dereferences the buffer as a header before verifying that sufficient data is present.