HIGH Introduced in 6.3
ath12k WmiHdr OOB
CVE-2026-92497
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() Currently, in ath12k_wmi_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread. Update the logic to verify the buffer contains at least enough data to hold a wmi_cmd_hdr before reading from the buffer. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
02KernelScan AI Analysis
Risk summary
The ath12k Wi-Fi driver reads a firmware event buffer without first checking it contains enough bytes for the WMI command header, so a malformed or maliciously crafted firmware event can cause an out-of-bounds read. An attacker who can inject or craft firmware-to-host WMI messages (e.g. via a compromised or malicious Wi-Fi firmware, or by tampering with the PCIe-attached WLAN device) could trigger this overread, potentially leaking kernel memory or crashing the kernel. Devices without the affected Qualcomm Wi-Fi 7 hardware are not impacted.
Vulnerability analysis
The ath12k driver processes messages from the Wi-Fi firmware by reading a command header from a buffer before checking whether the buffer is actually large enough to contain that header. A truncated or malformed firmware message causes the driver to read past the end of the buffer. The fix validates the buffer length before any data is read, ensuring the header is only accessed when the full structure is present. The vulnerable path is reached when the host receives WMI events from the PCIe-attached Qualcomm Wi-Fi 7 firmware; it requires the ath12k driver and supported hardware to be present and is not reachable from the network or from unprivileged local users.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 6.3 | 6.6.157 | 9784faa6afd2 |
| 6.12 | 6.3 | 6.12.110 | 07659388110d |
| 6.18 | 6.3 | 6.18.52 | 95d1bd1db9e9 |
| 7.2 | 6.3 | 7.2.6 | 9e6ec0977f0b |
| mainline | 6.3 | 7.3-rc1 | 7698656a2f7b |
| cip/6.12 | 6.3 | 6.12.111-cip32 | 07659388110d |