Executive brief
The ath11k Wi-Fi driver in the Linux kernel contains an out-of-bounds read vulnerability in its handling of channel switch announcement (CSA) events from wireless firmware. An attacker-controlled or compromised Wi-Fi device could provide a malicious CSA event with an invalid array length, causing the kernel to read memory beyond the allocated buffer. This could lead to information disclosure or a kernel crash, affecting system stability and potentially exposing sensitive kernel data.
Technical details
This is an out-of-bounds read vulnerability in the ath11k_wmi_process_csa_switch_count_event() function within the ath11k Wi-Fi driver. The vulnerability stems from two root causes: (1) the absence of a TLV (Type-Length-Value) policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, which fails to enforce minimum struct length validation, and (2) the num_vdevs field from firmware being used directly as a loop bound without validation against the actual vdev_ids array payload length. An attacker with control over firmware behavior (or via a malicious Wi-Fi device) can craft a CSA event with num_vdevs exceeding the available buffer, triggering out-of-bounds memory reads. The fix adds proper TLV policy validation and bounds-checks num_vdevs against the actual payload length before iteration. No remote network vector exists; exploitation requires local wireless device interaction or firmware compromise.
Affected products
- Linux Linux kernel through 2026-07-24 (fixed in later versions)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-07-24: patched: Fix committed upstream; backported to stable trees by 2026-09-14