HIGH Introduced in 6.3
ath12k MacPhyCaps Overflow
CVE-2026-90399
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() Currently, in ath12k_wmi_mac_phy_caps_parse(), kzalloc() sizes the mac_phy_caps buffer as tot_phy_id * len, where len is clamped to min(firmware_len, sizeof(struct ath12k_wmi_mac_phy_caps_params)). The subsequent memcpy() destination advances by sizeof(full struct) per slot via C pointer arithmetic, not by the clamped len. When firmware sends short TLVs, the second and later slots are written past the end of the allocation. The reader in ath12k_pull_mac_phy_cap_svc_ready_ext() also indexes the buffer with full-struct pointer arithmetic, so the allocation must match that stride. Fix by using kzalloc_objs(), which derives the element size from the pointer type, making allocation size and pointer stride provably consistent regardless of what len the firmware provides. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
02KernelScan AI Analysis
Risk summary
A heap buffer overflow in the ath12k WiFi driver allows an attacker within WiFi range to corrupt kernel heap memory by influencing firmware TLV lengths during device initialization. The overflow can lead to kernel crashes, memory disclosure, or potentially code execution. Any system using a Qualcomm Wi-Fi 7 chipset (WCN7850 or QCN9274) with the ath12k driver is affected.
Vulnerability analysis
The ath12k WiFi driver allocates a buffer for firmware MAC/PHY capability descriptors sized by the firmware-supplied TLV length, but then writes into that buffer using full-struct-sized pointer arithmetic. When the firmware sends TLVs shorter than the full struct, the allocation is undersized relative to the write stride, causing the second and subsequent entries to be written past the end of the heap buffer. The fix changes the allocation to always use the full struct size as the element stride, ensuring the buffer is large enough regardless of what TLV length the firmware provides. This is reachable by an attacker within WiFi range who can influence firmware behavior to send short TLVs during the service-ready event, or by a local user who can trigger firmware reinitialization.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.3 | 6.12.110 | d3355e0fdbbf |
| 6.18 | 6.3 | 6.18.52 | b9a5d12cbdeb |
| 6.6 | 6.3 | 6.6.160 | 79c6f4f7d16e |
| 7.2 | 6.3 | 7.2.6 | 26f8f87f0a55 |
| mainline | 6.3 | 7.3 | 4c6eb712a91f |
| cip/6.12 | 6.3 | 6.12.111-cip32 | d3355e0fdbbf |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |