HIGH Introduced in 5.6
ath11k MacPhyCaps Overflow
CVE-2026-90398
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.6HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() Currently, in ath11k_wmi_tlv_mac_phy_caps_parse(), kcalloc() sizes the mac_phy_caps buffer as tot_phy_id * len, where len is clamped to min(firmware_len, sizeof(struct wmi_mac_phy_capabilities)). The subsequent memcpy() destination advances by sizeof(full struct) per slot via C pointer arithmetic, not by the clamped len. When firmware sends short TLVs, the second and later slots are written past the end of the allocation. The reader in ath11k_pull_mac_phy_cap_svc_ready_ext() also indexes the buffer with full-struct pointer arithmetic, so the allocation must match that stride. Fix by using kzalloc_objs(), which derives the element size from the pointer type, making allocation size and pointer stride provably consistent regardless of what len the firmware provides. Compile tested only.
02KernelScan AI Analysis
Risk summary
The ath11k WiFi driver allocates a buffer sized by the firmware's reported TLV length but writes into it using full-struct pointer arithmetic, causing heap out-of-bounds writes when firmware sends short TLVs. An attacker within WiFi range who can trigger firmware reinitialization (e.g., via a crash) could exploit this to corrupt kernel heap memory, potentially leading to code execution or a kernel crash. Systems without ath11k WiFi hardware are unaffected.
Vulnerability analysis
The ath11k WiFi driver allocates a buffer for firmware capability descriptors using a size derived from the firmware's reported TLV length, which may be smaller than the full capability structure. However, both the write and read paths advance through this buffer using full-struct-sized pointer arithmetic. When firmware sends shorter-than-expected TLVs, the allocation is too small for the stride used by subsequent writes, causing out-of-bounds heap writes starting at the second entry. The fix changes the allocation to always use the full structure size as the element size, ensuring the buffer is large enough regardless of what length the firmware reports, while still clamping the copy length to avoid reading past the firmware's TLV data. This is reachable by an attacker within WiFi range who can trigger firmware behavior that produces short capability TLVs, or by a local user who can initiate firmware reinitialization on a system with ath11k WiFi hardware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 5.6 | 6.18.52 | 75185e2b214e |
| 7.2 | 5.6 | 7.2.6 | acff2713c321 |
| mainline | 5.6 | 7.3-rc1 | 7a246c72132e |
| 6.12 | 5.6 | 6.12.110 | bbb3b3334a9e |
| cip/6.12 | 5.6 | 6.12.111-cip32 | bbb3b3334a9e |