Cloudanix VulnDB

CVE-2026-92496

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how certain WiFi hardware drivers handle incoming messages from the device could let an attacker read small amounts of kernel memory or cause crashes on affected computers.

Exploitation
Other
Attacker needs
Other
Complexity
High
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing length validation on incoming firmware WMI event buffers allows out-of-bounds read of the wmi_cmd_hdr structure before any skb_pull or header processing occurs.

Why it matters to the business

Systems using ath11k WiFi hardware may experience kernel memory disclosure or crashes triggered by malformed or malicious firmware events, potentially disrupting wireless connectivity on affected Linux hosts.

How an attack unfolds

An attacker with the ability to supply crafted WMI event buffers (via compromised firmware, driver injection, or hardware-level manipulation) sends undersized packets; the kernel dereferences skb->data without a prior length check, reading past the supplied data and enabling overread.

How to fix it

Apply the upstream kernel patch that adds an explicit length check before dereferencing skb->data as wmi_cmd_hdr in ath11k_wmi_tlv_op_rx(); rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the fix by inspecting the ath11k_wmi.c source for the added length check preceding trace_ath11k_wmi_event(), or verify the running kernel contains the commit that resolved the buffer overread.

Typical attack path

  1. Gain control over or spoof WMI event delivery to the ath11k driver
  2. Craft a WMI event skb whose total length is smaller than sizeof(struct wmi_cmd_hdr)
  3. Trigger ath11k_wmi_tlv_op_rx() so the unchecked skb->data access occurs
  4. Observe resulting kernel oops, memory leak, or crash for further exploitation

How to detect it

Search kernel logs for ath11k-related oops or page-fault messages immediately after WMI event processing; correlate with unusual firmware event sizes or repeated ath11k_wmi_tlv_op_rx entries.

What your security team should do

  • Prioritize kernel updates containing the ath11k length-check patch on all WiFi-enabled Linux systems
  • Monitor vendor and distribution advisories for backported fixes in supported kernels
  • Limit exposure by disabling ath11k hardware where feasible until patched kernels are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread. Add an upfront length check before dereferencing skb->data as a wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event() call to preserve the existing trace semantics (tracing the full raw WMI event including the header), unlike the analogous ath12k fix which could use skb_pull_data() directly. Compile tested only.

Affected packages

Ecosystem Package Introduced Fixed