CVE-2026-92497wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() Currently, in ath12k_wmi_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread. Update the logic to verify the buffer contains at least enough data to hold a wmi_cmd_hdr before reading from the buffer. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d889913205cf7ebda905b1e62c5867ed4e39f6c2 before 9784faa6afd26693287e8e4569bdedee00212909; from d889913205cf7ebda905b1e62c5867ed4e39f6c2 before 07659388110de004cbb753f3c7bc85e657e51f7a; from d889913205cf7ebda905b1e62c5867ed4e39f6c2 before 95d1bd1db9e9d8eccffc880166e01c4775115716; from d889913205cf7ebda905b1e62c5867ed4e39f6c2 before 9e6ec0977f0b9c16fc20efea050e3eea8f66e34b; from d889913205cf7ebda905b1e62c5867ed4e39f6c2 before 7698656a2f7b045af5a6859766238cefea1b1945 | CNA record |
References
- https://git.kernel.org/stable/c/9784faa6afd26693287e8e4569bdedee00212909
- https://git.kernel.org/stable/c/07659388110de004cbb753f3c7bc85e657e51f7a
- https://git.kernel.org/stable/c/95d1bd1db9e9d8eccffc880166e01c4775115716
- https://git.kernel.org/stable/c/9e6ec0977f0b9c16fc20efea050e3eea8f66e34b
- https://git.kernel.org/stable/c/7698656a2f7b045af5a6859766238cefea1b1945
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.