Executive brief
The Linux kernel's ath11k WiFi driver processes wireless management interface (WMI) events from firmware without first validating that the incoming data buffer contains enough bytes for the message header. This could allow malformed or truncated firmware messages to trigger a buffer overread, potentially leaking kernel memory or causing a system crash.
Technical details
The vulnerability is a buffer overread in the ath11k_wmi_tlv_op_rx() function in drivers/net/wireless/ath/ath11k/wmi.c. The function processes WMI events from firmware by dereferencing skb->data as a wmi_cmd_hdr structure without first verifying that the socket buffer (skb) contains at least sizeof(wmi_cmd_hdr) bytes. The fix adds an upfront length check (if (skb->len < sizeof(*cmd_hdr))) before dereferencing the header, placed before the trace call to preserve existing tracing semantics. The vulnerability requires processing a specially crafted firmware message, which is an adjacent/local attack vector (firmware interaction). The patch was merged into the Linux stable tree in September 2026.
Affected products
- Linux Linux kernel multiple versions in drivers/net/wireless/ath/ath11k (ath11k driver for Qualcomm IEEE 802.11ax devices, originally introduced by d5c65159f289)
Timeline
- 2026-09-17: disclosed: CVE-2026-92496 published on NVD
- 2026-09-14: patched: Patch merged into Linux stable tree (commit 20166fd9a4ad15d7eccc63c9dc99680aea6558ef)