CVE-2026-90407

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90407", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.812Z", "datePublished": "2026-09-17T16:09:35.420Z", "dateUpdated": "2026-10-30T12:35:30.286Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:35:30.286Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()\n\nThere is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so\nthe parse infrastructure does not enforce a minimum length for the event\nstruct. Additionally, the num_vdevs field is taken directly from firmware\nand used as a loop bound over the vdev_ids array without checking that it\nfits within the TLV payload. Either condition can cause an out-of-bounds\nread.\n\nAdd a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so\nthe parse infrastructure enforces a minimum length for the fixed-size event\nstruct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload\nlength of a parsed TLV from the header preceding its data pointer. Use it\nin ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before\nthe loop.\n\nCompile tested only."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed bytes are firmware WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID TLVs on CE2 (ath11k_ce_recv_process_cb \u2192 ath11k_htc_rx_completion_handler \u2192 ath11k_wmi_tlv_op_rx). num_vdevs and the event/ARRAY_UINT32 lengths are built by firmware, not taken from an 802.11 CSA IE, so this is a host-firmware HTC path, not WiFi frame injection.\nAC:L - wmi_tlv_policies had no min_len for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, and ath11k_wmi_process_csa_switch_count_event() used ev->num_vdevs as the vdev_ids[] bound with no compare to the ARRAY_UINT32 TLV length. Firmware setting current_switch_count=0 and an oversized num_vdevs makes the overread deterministic, with no race.\nPR:N - ath11k_wmi_tlv_op_rx() dispatches WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID from the WMI HTC rx callback with no host uid, capability, or authentication check; the device firmware is the sole source of the event struct and vdev_ids array.\nUI:N - Firmware can send WMI_PDEV_CSA_SWITCH_COUNT_STATUS_EVENTID unsolicited on the WMI RX path; the overread of ev->current_switch_count/num_vdevs and vdev_ids[i] runs before the csa_active check and does not require the victim to start a channel switch, mount media, or open a file.\nS:U - The out-of-bounds loads of ev fields and vdev_ids[] stay inside the host kernel ath11k WMI parser and the CE RX skb heap; they do not cross a VM, IOMMU, or other separate security authority.\nC:H - ev->num_vdevs is a firmware u32 used as an unbounded index over vdev_ids[], so a count past the ARRAY_UINT32 TLV reads kernel heap beyond the WMI skb; unknown ids are also printed by ath11k_warn(\"Recvd csa status for unknown vdev %d\"). That is not a few-byte leak.\nI:N - The loop only reads vdev_ids[i] into ath11k_mac_get_arvif_by_vdev_id(); it never writes through the overread pointer. ieee80211_csa_finish() runs only if a looked-up vif already has csa_active, which is not an OOB write or hijack primitive from the overread.\nA:H - A firmware-chosen num_vdevs that walks vdev_ids[] past the CE RX skb can load from unmapped heap and oops/panic in ath11k_wmi_process_csa_switch_count_event(), which is a full kernel availability loss."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/wmi.c"], "versions": [{"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "57e77a6d900e5bc6e73ccd3ee1ba3bce834c9dde", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f760b7d7e43584d2fa9bffcec1a04e502609f827", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "0364926fb4bfb5b798e5fe2785b3023b4f767327", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "5de2b8c53714ad58f2fda118cd29ebbe31b38665", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "208d7fdb85976a737a715b81d54efaff6703880c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/wmi.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/57e77a6d900e5bc6e73ccd3ee1ba3bce834c9dde"}, {"url": "https://git.kernel.org/stable/c/f760b7d7e43584d2fa9bffcec1a04e502609f827"}, {"url": "https://git.kernel.org/stable/c/d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce"}, {"url": "https://git.kernel.org/stable/c/0364926fb4bfb5b798e5fe2785b3023b4f767327"}, {"url": "https://git.kernel.org/stable/c/5de2b8c53714ad58f2fda118cd29ebbe31b38665"}, {"url": "https://git.kernel.org/stable/c/208d7fdb85976a737a715b81d54efaff6703880c"}], "title": "wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/wmi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "57e77a6d900e5bc6e73ccd3ee1ba3bce834c9dde", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "f760b7d7e43584d2fa9bffcec1a04e502609f827", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "0364926fb4bfb5b798e5fe2785b3023b4f767327", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "5de2b8c53714ad58f2fda118cd29ebbe31b38665", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "208d7fdb85976a737a715b81d54efaff6703880c", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/wmi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()\n\nThere is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so\nthe parse infrastructure does not enforce a minimum length for the event\nstruct. Additionally, the num_vdevs field is taken directly from firmware\nand used as a loop bound over the vdev_ids array without checking that it\nfits within the TLV payload. Either condition can cause an out-of-bounds\nread.\n\nAdd a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so\nthe parse infrastructure enforces a minimum length for the fixed-size event\nstruct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload\nlength of a parsed TLV from the header preceding its data pointer. Use it\nin ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before\nthe loop.\n\nCompile tested only."}], "id": "CVE-2026-90407", "lastModified": "2026-10-30T13:20:52.373", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-17T17:17:40.573", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0364926fb4bfb5b798e5fe2785b3023b4f767327"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/208d7fdb85976a737a715b81d54efaff6703880c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57e77a6d900e5bc6e73ccd3ee1ba3bce834c9dde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5de2b8c53714ad58f2fda118cd29ebbe31b38665"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f760b7d7e43584d2fa9bffcec1a04e502609f827"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()", "id": "2536570", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536570"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()\nThere is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so\nthe parse infrastructure does not enforce a minimum length for the event\nstruct. Additionally, the num_vdevs field is taken directly from firmware\nand used as a loop bound over the vdev_ids array without checking that it\nfits within the TLV payload. Either condition can cause an out-of-bounds\nread.\nAdd a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so\nthe parse infrastructure enforces a minimum length for the fixed-size event\nstruct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload\nlength of a parsed TLV from the header preceding its data pointer. Use it\nin ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before\nthe loop.\nCompile tested only.", "A flaw was found in the Linux kernel's ath11k Wi-Fi driver. This vulnerability arises from insufficient validation of firmware input, specifically the num_vdevs field, which is used as a loop bound without proper size checks. An attacker could exploit this to trigger an out-of-bounds read, potentially leading to information disclosure from kernel memory. This issue occurs during the processing of Channel Switch Announcement (CSA) events."], "name": "CVE-2026-90407", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-90407\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-90407\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90407.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d5c65159f2895379e11ca13f62feabe93278985d,f760b7d7e43584d2fa9bffcec1a04e502609f827)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d5c65159f2895379e11ca13f62feabe93278985d,d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d5c65159f2895379e11ca13f62feabe93278985d,0364926fb4bfb5b798e5fe2785b3023b4f767327)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d5c65159f2895379e11ca13f62feabe93278985d,5de2b8c53714ad58f2fda118cd29ebbe31b38665)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d5c65159f2895379e11ca13f62feabe93278985d,208d7fdb85976a737a715b81d54efaff6703880c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.52,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-19T14:00:15.417818+00:00", "updated": "2026-09-20T00:45:16.464119+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125"]}