CVE-2026-90408
High · 7.7CVSS
7.7
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A flaw in certain Wi-Fi hardware drivers inside the Linux kernel can let a local user read parts of kernel memory or crash the system.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds read in the ath12k WMI event parser caused by missing TLV policy enforcement for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and direct use of an unvalidated num_vdevs loop bound taken from firmware.
Why it matters to the business
Systems using ath12k Wi-Fi hardware can experience kernel memory disclosure or crashes, leading to local information leaks or denial of service that disrupts wireless connectivity and requires reboots.
How an attack unfolds
An attacker with local access supplies a crafted or truncated WMI CSA switch count event from firmware; the missing length check allows the loop over vdev_ids to read past the TLV payload boundary, disclosing adjacent kernel memory or triggering a fault.
How to fix it
Apply the upstream kernel commit that adds the TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and the ath12k_wmi_tlv_data_len helper to bound the vdev loop; rebuild and deploy the patched kernel on all affected systems.
How to confirm the fix worked
Confirm the TLV policy table contains an entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and that ath12k_wmi_process_csa_switch_count_event calls ath12k_wmi_tlv_data_len before using num_vdevs as a loop limit.
Typical attack path
- Obtain local execution or user context on a system with ath12k hardware
- Trigger or inject a WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT with insufficient payload length or oversized num_vdevs
- Cause the parser to iterate beyond the TLV data and read out-of-bounds kernel memory
- Exfiltrate disclosed memory contents or induce a kernel panic
How to detect it
Review kernel logs for ath12k WMI parse warnings, out-of-bounds access reports, or crashes in ath12k_wmi_process_csa_switch_count_event; correlate with recent firmware CSA events on affected hardware.
What your security team should do
- Prioritize kernel updates on all ath12k-equipped hosts within standard patch windows
- Monitor vendor and distribution advisories for backported fixes
- Limit local unprivileged access where feasible until patches are deployed
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read. Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so the parse infrastructure enforces a minimum length for the fixed-size event struct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload length of a parsed TLV from the header preceding its data pointer. Use it in ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before the loop. Compile tested only.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|