HIGH Introduced in 5.7
ath11k UndecapNwifi Corruption
CVE-2026-97442
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields in the header within the ath11k_dp_rx_h_undecap_nwifi() function for the DP_RX_DECAP_TYPE_NATIVE_WIFI decap type and potentially result in invalid data access and memory corruption. Kernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k] Call trace: ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k] ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k] ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k] ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k] ath11k_dp_service_srng+0x2e0/0x348 [ath11k] Add a sanity check before processing the SKB to prevent invalid data access in the undecap native Wi-Fi function for the DP_RX_DECAP_TYPE_NATIVE_WIFI decap type. This adapted from the discussion/patch of the ath12k driver [1]. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
02KernelScan AI Analysis
Risk summary
A remote attacker within WiFi range of a device using ath11k wireless hardware can send crafted frames that cause the driver to process packets with oversized native Wi-Fi headers, leading to kernel stack corruption. This can result in kernel panic, denial of service, or potentially arbitrary code execution in the kernel. Any system with ath11k WiFi hardware and the driver loaded is at risk.
Vulnerability analysis
The ath11k WiFi driver processes received packets without validating that the native Wi-Fi header length reported by hardware is within the expected maximum. When the hardware provides a packet with an unexpectedly long header for the native Wi-Fi decapsulation type, the driver's undecapsulation function accesses and modifies memory beyond the valid header region, corrupting the kernel stack. The fix adds a validation check that compares the parsed header length against the maximum allowed native Wi-Fi header length before any further processing, dropping the packet if the check fails. This vulnerability is reachable by any device within WiFi range of an affected system using ath11k hardware — no authentication or privileges are required, only the ability to transmit WiFi frames that the target's hardware will deliver to the driver.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.7 | 6.1.189 | 958cf3696ddc |
| 6.6 | 5.7 | 6.6.158 | b4ef30f1d107 |
| 6.12 | 5.7 | 6.12.111 | 1c0a13be76db |
| 6.18 | 5.7 | 6.18.53 | 00738665c875 |
| mainline | 5.7 | 7.2 | 6b471e9aefee |
| cip/6.12 | 5.7 | 6.12.111-cip32 | 1c0a13be76db |