UBUNTU-CVE-2026-92497: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid buffer overread in ath12kwmioprx() Currently, in ath12kwmioprx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread. Update the logic to verify the buffer contains at least enough data to hold a wmicmdhdr before reading from the buffer. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPLV1.0V2.0SILICONZUPSTREAM-3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are most likely to be exposed?
Exposure is limited to the listed Ubuntu kernel packages and involves the ath12k Wi-Fi driver. Systems using hardware supported by ath12k, including the tested WCN7850 PCI WLAN hardware, are the relevant population.
What condition triggers the overread?
The issue occurs when ath12k_wmi_op_rx() processes a firmware buffer that is too short to contain a wmi_cmd_hdr. The vulnerable logic reads the header before confirming that sufficient buffer data is present.
How can I determine whether the fix is present?
Check whether the installed Ubuntu kernel package includes the upstream change identified by commit 7698656a2f7b045af5a6859766238cefea1b1945. The corrected logic validates that the received buffer is large enough for a wmi_cmd_hdr before accessing it.