Executive brief
The ath12k WiFi driver in the Linux kernel processes firmware messages without verifying the message buffer contains enough data for a header. An attacker or malfunctioning device could send a crafted message triggering an out-of-bounds memory read, potentially exposing kernel memory or causing a crash.
Technical details
This is a buffer overread vulnerability in the ath12k_wmi_op_rx() function within the Qualcomm ath12k WiFi 7 driver. The vulnerable code reads a WMI command header from a firmware buffer without first verifying the buffer contains sufficient data. The fix changes the code to use skb_pull_data() instead of a direct cast, which atomically verifies the buffer has at least sizeof(wmi_cmd_hdr) bytes before extracting the header. Attack preconditions require the attacker to either control the firmware (malicious device) or intercept and modify WiFi frames. The vulnerability could leak kernel memory or cause a kernel oops; no remote code execution is indicated.
Affected products
- Linux Linux kernel ath12k driver (from Linux 6.10 onward based on original commit date)
Timeline
- 2026-09-17: disclosed
- 2026-07-16: patched: Patch committed upstream; included in stable kernel releases
- 2026-07-22: other: Patch merged into stable tree