CVE-2026-92496 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread.
Add an upfront length check before dereferencing skb->data as a wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event() call to preserve the existing trace semantics (tracing the full raw WMI event including the header), unlike the analogous ath12k fix which could use skb_pull_data() directly.
Compile tested only.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel driver for Qualcomm Atheros ath11k wireless network adapters contains a critical memory safety flaw within its Wireless Management Interface (WMI) event processing logic, specifically in the function ath11k_wmi_tlv_op_rx(). This vulnerability arises from an insufficient validation of input data length before accessing buffer contents. In normal operation, this driver receives binary events and commands from the device firmware via a socket buffer structure known as sk_buff or skb. The code attempts to interpret the beginning of this buffer as a WMI command header by casting the raw pointer skb->data directly into a wmi_cmd_hdr struct type without first confirming that the available data length is sufficient to contain at least one complete header instance.
This lack of bounds checking creates a classic out-of-bounds read condition, categorized under CWE-126 Buffer Over-read in industry standard vulnerability taxonomies. When the firmware sends a malformed or truncated packet where the payload size is smaller than the expected WMI header structure, the kernel will proceed to dereference memory addresses that lie beyond the allocated buffer boundaries. This action results in reading arbitrary data from adjacent kernel memory spaces rather than valid protocol fields. Such behavior violates fundamental principles of secure coding and input validation, exposing the system to potential information disclosure or instability depending on what resides in the neighboring memory regions at runtime.
The operational impact of this vulnerability is primarily related to system stability and security posture. An attacker with the ability to influence firmware communication patterns, potentially through physical access to the device or sophisticated wireless injection attacks if the interface allows untrusted frame processing, could trigger this code path by sending specially crafted WMI events. The immediate consequence is a kernel memory overread which may lead to unpredictable behavior including kernel panics, crashes, or denial of service conditions due to invalid data interpretation in subsequent logic blocks that rely on header fields like command IDs and lengths. While the description notes compile-tested status only, indicating limited runtime verification during patch submission, the theoretical risk remains significant for systems relying on this driver for critical connectivity functions.
Mitigation strategies involve applying the upstream kernel patches provided by Linux distribution maintainers to ensure the length check is enforced prior to any pointer dereference operations. The fix implements an explicit validation step that verifies the remaining data in the socket buffer meets or exceeds the size of a wmi_cmd_hdr before casting and accessing it. This approach preserves existing tracing semantics, allowing trace_ath11k_wmi_event() to log full raw events for debugging purposes while preventing unsafe memory access. Security administrators should monitor for kernel updates addressing this specific ath11k driver issue and ensure that firmware interactions are strictly controlled within trusted environments where possible.
From a threat modeling perspective aligned with MITRE ATT&CK, this vulnerability facilitates reconnaissance or disruption activities by allowing an adversary to probe internal kernel state through side-channel effects of memory reads or cause service interruption via crashes. It represents a failure in input validation mechanisms typical of driver-level software defects. Remediation requires strict adherence to defensive programming practices where all external data sources are validated against expected structural constraints before processing. Organizations deploying hardware utilizing ath11k chipsets must prioritize patching these drivers to eliminate the risk associated with malformed WMI event handling and maintain robust kernel integrity protections such as KASLR and stack canaries which may mitigate exploitation attempts even if the overread occurs.