CVE-2026-90398

What it actually does

Out-of-bounds write in ath11k mac_phy_caps buffer because kcalloc allocation uses a clamped TLV length while subsequent memcpy and indexing operations advance by full struct wmi_mac_phy_capabilities size via pointer arithmetic.

Why it matters to the business

Local memory corruption on Linux systems using ath11k-based WiFi hardware can cause kernel crashes, denial of service, or potential privilege escalation; low exploit maturity and absence from known campaigns limit immediate widespread risk.

How an attack unfolds

An attacker supplies or influences firmware TLV responses that report short mac_phy_capabilities structures; the driver allocates a undersized buffer yet performs full-stride writes, corrupting adjacent kernel memory during WMI service-ready parsing.

How to fix it

Apply the upstream fix that replaces kcalloc with kzalloc_objs to enforce consistent element sizing; rebuild and deploy updated Linux kernel images containing the corrected ath11k WMI parsing code.

How to confirm the fix worked

Inspect ath11k_wmi.c for kzalloc_objs usage in mac_phy_caps allocation paths and confirm absence of manual len clamping before memcpy; test with firmware that emits short TLVs to verify no overflow occurs.

Typical attack path

1. Gain local access or control over ath11k firmware responses on target system
2. Trigger ath11k_wmi_tlv_mac_phy_caps_parse with undersized TLVs
3. Induce out-of-bounds memcpy writes via pointer stride mismatch
4. Escalate via corrupted kernel structures or cause denial of service

How to detect it

Review kernel logs for ath11k oops, page faults, or warnings during WMI capability parsing; correlate with recent firmware loads or WiFi initialization events.

What your security team should do

• Prioritize kernel updates on all systems exposing ath11k WiFi drivers
• Monitor for ath11k-related kernel panics in system logs
• Restrict untrusted firmware loading until patched kernels are deployed