CVE-2026-92496wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread. Add an upfront length check before dereferencing skb->data as a wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event() call to preserve the existing trace semantics (tracing the full raw WMI event including the header), unlike the analogous ath12k fix which could use skb_pull_data() directly. Compile tested only.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d5c65159f2895379e11ca13f62feabe93278985d before 20166fd9a4ad15d7eccc63c9dc99680aea6558ef; from d5c65159f2895379e11ca13f62feabe93278985d before 71690d26c1415e816158b45ee354367244c50d4c; from d5c65159f2895379e11ca13f62feabe93278985d before f9726f6d97dca94ab14739c8b632301a940a7e8f; from d5c65159f2895379e11ca13f62feabe93278985d before 2677fc48dd10dc08cdec99c2692d50fe5f48dcbf; from d5c65159f2895379e11ca13f62feabe93278985d before 9652e7e23137538169f60323300cae3413475685; from d5c65159f2895379e11ca13f62feabe93278985d before 72a5e45f606ec454ef556a68ffd92e06b0677f44; from d5c65159f2895379e11ca13f62feabe93278985d before 9ddbc95dac167e3f2d0e3859e6ce022ae0184fc1; from d5c65159f2895379e11ca13f62feabe93278985d before 9ef9dd30058cc9223c72f711dca1a28a5947d0c5 | CNA record |
References
- https://git.kernel.org/stable/c/20166fd9a4ad15d7eccc63c9dc99680aea6558ef
- https://git.kernel.org/stable/c/71690d26c1415e816158b45ee354367244c50d4c
- https://git.kernel.org/stable/c/f9726f6d97dca94ab14739c8b632301a940a7e8f
- https://git.kernel.org/stable/c/2677fc48dd10dc08cdec99c2692d50fe5f48dcbf
- https://git.kernel.org/stable/c/9652e7e23137538169f60323300cae3413475685
- https://git.kernel.org/stable/c/72a5e45f606ec454ef556a68ffd92e06b0677f44
- https://git.kernel.org/stable/c/9ddbc95dac167e3f2d0e3859e6ce022ae0184fc1
- https://git.kernel.org/stable/c/9ef9dd30058cc9223c72f711dca1a28a5947d0c5
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.