Executive brief
The Qualcomm ath12k WiFi driver in the Linux kernel contains a buffer overflow vulnerability in its firmware parsing code. When processing wireless capability data from device firmware, the driver allocates a buffer with incorrect size and writes beyond its bounds. This could allow an attacker to corrupt kernel memory, leading to system crash, privilege escalation, or code execution on systems using affected Qualcomm WiFi 7 devices.
Technical details
The vulnerability exists in ath12k_wmi_mac_phy_caps_parse() where kzalloc() sizes a buffer using (tot_phy_id * len), but len is clamped to min(firmware_len, sizeof(struct ath12k_wmi_mac_phy_caps_params)). However, subsequent memcpy() operations advance by full struct size via pointer arithmetic, not the clamped len. When firmware sends short TLVs (Type-Length-Value structures), writes to the second and later slots exceed the allocation, causing a heap buffer overflow. The reader function also uses full-struct pointer arithmetic, requiring allocation and stride to match. The fix replaces kzalloc() with kzalloc_objs(), which derives element size from the pointer type, ensuring consistency. The vulnerability affects systems with Qualcomm WCN7850 WiFi 7 hardware and potentially other ath12k-supported devices.
Affected products
- Linux Linux kernel 5.10 and later
Timeline
- 2026-07-28: disclosed: Fix commit authored
- 2026-09-14: patched: Patch merged into stable kernel
- 2026-09-17: advisory: CVE-2026-90399 published