UBUNTU-CVE-2026-90408: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12kwmiprocesscsaswitchcountevent() There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the numvdevs field is taken directly from firmware and used as a loop bound over the vdevids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath12kwmitlvdatalen() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath12kwmiprocesscsaswitchcountevent() to bound numvdevs before the loop. Compile tested only.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT to enforce the minimum length of the fixed-size event structure; add ath12k_wmi_tlv_data_len() to recover the parsed TLV payload length from the header preceding the data pointer, and use it in ath12k_wmi_process_csa_switch_count_event() to verify that num_vdevs fits within the vdev_ids TLV payload before using it as the loop bound.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local attack access, with no privileges or user interaction required. Exploitation depends on processing a malformed CSA switch-count event from firmware.
Which Ubuntu kernel package families are listed as affected?
The listed package families are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
What is the potential impact if the malformed event is processed?
The malformed event can cause an out-of-bounds read in the ath12k driver. The provided CVSS metrics rate confidentiality and availability impact as high, with no integrity impact.
What checks does the fix add?
The fix adds a TLV policy entry to enforce the fixed event structure's minimum length. It also bounds the firmware-provided num_vdevs value against the actual TLV payload length before iterating over vdev_ids.