CVE-2026-92497 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
Currently, in ath12k_wmi_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread.
Update the logic to verify the buffer contains at least enough data to hold a wmi_cmd_hdr before reading from the buffer.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel wireless driver for the Qualcomm ath12k family of network interfaces contains a critical input validation flaw within its Wireless Management Interface (WMI) operation reception routine, specifically in the function ath12k_wmi_op_rx. This vulnerability stems from an insufficient boundary check when processing incoming data buffers received from the firmware hardware interface. The core technical issue is that the driver attempts to parse and read header information from a buffer without first confirming that the available data length meets or exceeds the size of the required wmi_cmd_hdr structure. In systems where device drivers interact directly with hardware-generated streams, such as PCI-based WLAN controllers like the WCN7850 hw2.0 referenced in the patch context, it is imperative to validate payload sizes before dereferencing pointers or accessing memory offsets relative to a buffer start. Without this preliminary verification step, if the firmware sends a truncated packet or an unexpectedly short frame due to transmission errors, malformed data, or potential malicious manipulation of the device interface, the driver will proceed to read beyond the allocated bounds of the current buffer.
This lack of validation leads directly to a buffer overread condition, which falls under Common Weakness Enumeration category CWE-126: Buffer Over-read. When the kernel executes memory reads outside the designated limits of an object, it may expose sensitive information residing in adjacent memory regions that were not intended for this specific operation. Depending on how the operating system manages page faults and memory protection, such an overread can result in the leakage of internal kernel state, cryptographic keys, or other privileged data to user-space applications if the corrupted values are subsequently copied out. Alternatively, it may trigger a general protection fault leading to a denial of service by crashing the network subsystem or the entire system. The severity is compounded by the fact that WMI messages often control critical radio parameters and connection states; while this specific flaw primarily presents an information disclosure risk due to reading uninitialized memory rather than executing arbitrary code via buffer overflow, it undermines the integrity and confidentiality guarantees expected from secure kernel drivers.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates techniques associated with T1083: File and Directory Discovery or more broadly Data Exfiltration over Alternative Protocol if an attacker can induce repeated malformed packets to systematically map memory contents. It also relates to CWE-20: Improper Input Validation, as the root cause is the failure to sanitize or verify input data length against expected structural requirements before processing. The operational impact includes potential system instability and security breaches that could compromise user privacy or network integrity. Mitigation strategies involve applying the upstream kernel patch which introduces a strict size check ensuring that at least sizeof(struct wmi_cmd_hdr) bytes are present in the buffer prior to any read operations. Administrators should ensure their systems are updated with the latest stable Linux kernel versions containing this fix, particularly for devices utilizing ath12k hardware such as WCN7850 variants. Additionally, implementing strict network segmentation and monitoring for anomalous traffic patterns directed at wireless management interfaces can provide an additional layer of defense against exploitation attempts that rely on sending malformed frames to trigger these code paths.