Cloudanix VulnDB

CVE-2026-90399

High · 8.4

CVSS

8.4

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's handling of certain Wi-Fi hardware data could let someone with physical or local access crash the computer or take control of it.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in kernel memory when ath12k_wmi_mac_phy_caps_parse allocates a buffer using a clamped length but advances via full-struct pointer arithmetic, allowing firmware-provided short TLVs to overwrite adjacent memory.

Why it matters to the business

Systems using affected ath12k Wi-Fi hardware on Linux kernels risk crashes, data corruption, or local privilege escalation, potentially disrupting operations or enabling further compromise on laptops, embedded devices, and servers.

How an attack unfolds

An attacker with the ability to supply crafted WMI TLVs from firmware (via malicious hardware, compromised firmware image, or local kernel access) triggers the mismatched allocation and memcpy loop, writing attacker-controlled data past the buffer end to corrupt kernel structures.

How to fix it

Apply the upstream fix that replaces kzalloc with kzalloc_objs to ensure allocation size matches pointer stride; rebuild and deploy the corrected kernel image on all affected systems.

How to confirm the fix worked

Inspect the patched ath12k_wmi.c source to confirm kzalloc_objs usage; boot the updated kernel on WCN7850 or similar hardware and verify no crashes occur during WMI service-ready event processing.

Typical attack path

  1. Obtain local access or control over ath12k firmware TLV delivery
  2. Trigger ath12k_wmi_mac_phy_caps_parse with short TLV lengths
  3. Cause memcpy to write beyond kzalloc allocation using full-struct stride
  4. Corrupt adjacent kernel memory to achieve code execution or denial of service

How to detect it

Review kernel logs for ath12k oops, slab corruption warnings, or stack traces mentioning mac_phy_caps_parse and pull_mac_phy_cap_svc_ready_ext; correlate with unexpected firmware TLV events.

  • ath12k_wmi_mac_phy_caps_parse
  • kzalloc.*mac_phy_caps
  • ath12k_pull_mac_phy_cap_svc_ready_ext

What your security team should do

  • Prioritize kernel updates containing the kzalloc_objs change for any ath12k-equipped devices
  • Restrict local access and firmware update paths until patched kernels are deployed
  • Monitor for ath12k-related kernel oops or memory corruption reports in system logs

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() Currently, in ath12k_wmi_mac_phy_caps_parse(), kzalloc() sizes the mac_phy_caps buffer as tot_phy_id * len, where len is clamped to min(firmware_len, sizeof(struct ath12k_wmi_mac_phy_caps_params)). The subsequent memcpy() destination advances by sizeof(full struct) per slot via C pointer arithmetic, not by the clamped len. When firmware sends short TLVs, the second and later slots are written past the end of the allocation. The reader in ath12k_pull_mac_phy_cap_svc_ready_ext() also indexes the buffer with full-struct pointer arithmetic, so the allocation must match that stride. Fix by using kzalloc_objs(), which derives the element size from the pointer type, making allocation size and pointer stride provably consistent regardless of what len the firmware provides. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3

Affected packages

Ecosystem Package Introduced Fixed