Cloudanix VulnDB

CVE-2026-90407

High · 7.7

CVSS

7.7

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in certain WiFi hardware drivers could allow unauthorized memory access or system instability on Linux computers.

Exploitation
Local Privilege
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows out-of-bounds reads in the ath11k WiFi driver by processing a WMI event without enforcing minimum length or bounding the num_vdevs loop variable against the TLV payload size.

Why it matters to the business

Systems using affected Linux kernel versions with ath11k hardware may experience kernel memory disclosure or crashes, potentially leading to denial of service or information exposure on wireless-enabled devices.

How an attack unfolds

An attacker triggers the CSA switch count event with malformed or oversized data from firmware, causing the driver to read beyond allocated buffers in the kernel.

How to fix it

Apply the kernel patch that adds TLV policy for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and uses ath11k_wmi_tlv_data_len() to validate num_vdevs.

How to confirm the fix worked

Verify kernel source includes the policy entry and helper function; test with crafted events if possible.

Typical attack path

  1. Gain local access or control firmware to send WMI event
  2. Craft event with num_vdevs exceeding payload
  3. Trigger ath11k_wmi_process_csa_switch_count_event
  4. Read out-of-bounds memory

How to detect it

Look for kernel oops or panics related to ath11k_wmi_process_csa_switch_count_event in system logs.

What your security team should do

  • Update Linux kernel to patched version
  • Monitor for ath11k related crashes
  • Limit local access if possible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only.

Affected packages

Ecosystem Package Introduced Fixed