CVE-2026-92497: wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Avoid buffer overread in ath12kwmioprx()
Currently, in ath12kwmioprx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread.
Update the logic to verify the buffer contains at least enough data to hold a wmicmdhdr before reading from the buffer.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPLV1.0V2.0SILICONZUPSTREAM-3
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue is in the Linux kernel's ath12k Wi-Fi driver, specifically its WMI receive handling path. The provided data notes testing on WCN7850 hardware, but does not identify a complete list of affected devices or kernel versions.
What condition is required to trigger the overread?
The driver must receive a firmware buffer that is shorter than a WMI command header, and ath12k_wmi_op_rx() must process it. The vulnerable logic reads the header before confirming that sufficient buffer data is available.
How can I determine whether the fix is present?
Check whether your kernel includes the cited stable commits: 9784faa6afd26693287e8e4569bdedee00212909, 07659388110de004cbb753f3c7bc85e657e51f7a, or 95d1bd1db9e9d8eccffc880166e01c4775115716. The corrected logic verifies that the buffer is large enough for a wmi_cmd_hdr before reading it.