Executive brief
The Linux kernel's ath11k Wi-Fi driver contains a memory corruption vulnerability in its parsing of wireless firmware capability data. When processing firmware responses, a mismatch between buffer allocation and pointer arithmetic causes data to be written beyond the allocated memory boundary. An attacker with the ability to provide a malicious firmware image or intercept firmware communications could trigger a kernel crash or potentially execute arbitrary code.
Technical details
A stride mismatch vulnerability exists in the ath11k_wmi_tlv_mac_phy_caps_parse() function within the Linux kernel's ath11k Wi-Fi driver. The vulnerability occurs because kcalloc() sizes a buffer based on a clamped firmware-provided length value, but subsequent memcpy() operations use full struct pointer arithmetic, advancing by sizeof(wmi_mac_phy_capabilities) per iteration rather than the clamped length. When firmware provides shorter TLV structures, this causes writes to occur past the allocated buffer boundary on the second and subsequent iterations. The fix replaces kcalloc() with kzalloc_objs(), which derives element size directly from the pointer type, ensuring allocation and stride are consistent regardless of firmware input. The vulnerability requires processing a specially crafted firmware response and affects systems running affected Linux kernel versions with ath11k driver.
Affected products
- Linux Linux kernel 5.x-7.x (affected by ath11k driver code path)
Timeline
- 2026-07-28: other: Fix authored by Jeff Johnson
- 2026-07-30: patched: Commit 7a246c72132eb943b5844ba79dad597b47429dba merged upstream
- 2026-09-17: disclosed: CVE-2026-90398 published