CVE-2026-90398 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
Currently, in ath11k_wmi_tlv_mac_phy_caps_parse(), kcalloc() sizes the mac_phy_caps buffer as tot_phy_id * len, where len is clamped to min(firmware_len, sizeof(struct wmi_mac_phy_capabilities)). The subsequent memcpy() destination advances by sizeof(full struct) per slot via C pointer arithmetic, not by the clamped len. When firmware sends short TLVs, the second and later slots are written past the end of the allocation.
The reader in ath11k_pull_mac_phy_cap_svc_ready_ext() also indexes the buffer with full-struct pointer arithmetic, so the allocation must match that stride.
Fix by using kzalloc_objs(), which derives the element size from the pointer type, making allocation size and pointer stride provably consistent regardless of what len the firmware provides.
Compile tested only.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's ath11k wireless driver represents a classic heap-based buffer overflow resulting from an inconsistency between memory allocation sizing and subsequent pointer arithmetic operations. This flaw resides within the mac_phy_caps_parse function, which is responsible for parsing MAC PHY capabilities received via Wireless Management Interface (WMI) TLVs from the firmware. The core technical issue stems from how the destination buffer for these capabilities was allocated versus how it was accessed during data ingestion. Specifically, the original implementation utilized kcalloc to allocate memory based on a total count of physical identifiers multiplied by a length value that had been clamped against both the remaining firmware message length and the size of the wmi_mac_phy_capabilities structure. While this approach attempted to prevent over-allocation, it failed to account for the actual stride used during data copying operations.
The operational flaw manifests when the driver processes incoming TLVs from the wireless hardware. The code performs a memcpy operation where the destination pointer advances by the full size of the struct per slot using standard C pointer arithmetic. However, because the allocation was sized based on the clamped len value rather than the actual stride required for each element, there is a discrepancy between the allocated memory footprint and the access pattern. When the firmware sends short TLVs or when the clamping logic results in an allocation smaller than what is implied by the pointer arithmetic, subsequent writes to the second and later slots of the buffer exceed its boundaries. This constitutes a heap-based out-of-bounds write vulnerability that can corrupt adjacent kernel memory structures, potentially leading to system instability, denial of service through kernel panic, or more severe exploitation scenarios if an attacker can influence firmware behavior or network traffic patterns to trigger this code path with crafted inputs.
This type of error is categorized under CWE-120 Buffer Copy without Checking Size of Input in C/C++, as the copy operation does not verify that the input data fits within the allocated buffer boundaries relative to the access stride. Furthermore, from a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability aligns with Tactic TA0004 Privilege Escalation and specifically Technique T1068 Exploitation for Privilege Escalation if an attacker can leverage the memory corruption to overwrite function pointers or control flow data. It also relates to CWE-787 Out-of-bounds Write, highlighting the risk of writing beyond allocated heap regions which is a common precursor to arbitrary code execution in kernel space where ring 0 privileges are gained upon successful exploitation.
The mitigation implemented addresses this root cause by replacing kcalloc with kzalloc_objs. This change leverages object allocation semantics that derive the element size directly from the pointer type used for iteration, ensuring mathematical consistency between the total allocated memory and the stride applied during access. By aligning the allocation strategy with the actual usage pattern of full-struct pointer arithmetic, the driver guarantees that every slot written to falls within the bounds of the allocated buffer regardless of firmware-provided length values or TLV sizes. This fix eliminates the possibility of out-of-bounds writes in this specific parsing routine and restores memory safety integrity for ath11k device initialization sequences involving MAC PHY capability negotiation.