Cloudanix VulnDB

CVE-2026-92497

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A wireless driver in the Linux kernel could read past the end of a data buffer, which might cause crashes or leak small amounts of information until the system is updated.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing length validation on firmware-supplied WMI buffer allows ath12k_wmi_op_rx to read past the end of the allocation when interpreting wmi_cmd_hdr.

Why it matters to the business

Systems using affected Qualcomm Wi-Fi hardware may experience kernel crashes or limited information disclosure, increasing support burden and potential downtime until kernels are updated.

How an attack unfolds

An attacker with the ability to influence or emulate the firmware buffer passed to the WMI receive path supplies a truncated header; the driver reads the structure without a prior bounds check, resulting in an overread.

How to fix it

Update to a Linux kernel containing the buffer-length check before wmi_cmd_hdr access in ath12k_wmi_op_rx; rebuild and deploy the kernel on all affected hosts.

How to confirm the fix worked

Confirm the presence of the length check against sizeof(wmi_cmd_hdr) in ath12k_wmi_op_rx and verify the running kernel version matches a release that includes the fix.

Typical attack path

  1. Obtain control or emulation of the ath12k firmware-to-host buffer path
  2. Craft a WMI event smaller than sizeof(wmi_cmd_hdr)
  3. Trigger ath12k_wmi_op_rx on the undersized buffer
  4. Observe kernel memory read beyond allocation bounds

How to detect it

Review kernel logs for ath12k or WMI-related oops/panic entries around the time of suspected exposure; examine dmesg or journalctl for buffer-overread signatures in the ath12k module.

What your security team should do

  • Prioritize kernel updates on systems with WCN7850 or similar ath12k hardware
  • Monitor vendor advisories for backported fixes in distribution kernels
  • Test updated kernels in staging environments before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() Currently, in ath12k_wmi_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread. Update the logic to verify the buffer contains at least enough data to hold a wmi_cmd_hdr before reading from the buffer. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3

Affected packages

Ecosystem Package Introduced Fixed