High 8.8Published Sep 24, 2026

CVE-2026-97442wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields in the header within the ath11k_dp_rx_h_undecap_nwifi() function for the DP_RX_DECAP_TYPE_NATIVE_WIFI decap type and potentially result in invalid data access and memory corruption. Kernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k] Call trace: ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k] ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k] ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k] ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k] ath11k_dp_service_srng+0x2e0/0x348 [ath11k] Add a sanity check before processing the SKB to prevent invalid data access in the undecap native Wi-Fi function for the DP_RX_DECAP_TYPE_NATIVE_WIFI decap type. This adapted from the discussion/patch of the ath12k driver [1]. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from acc79d981c1462b22a7a2cb0d39725f8c01fc425 before 958cf3696ddc5ccafd3d0b8b0c03d90bcd771c0c; from acc79d981c1462b22a7a2cb0d39725f8c01fc425 before b4ef30f1d107aae460edf731a7c2d187fbc46a32; from acc79d981c1462b22a7a2cb0d39725f8c01fc425 before 1c0a13be76db3c1cf774aa11d9f4c3f8239ac567; from acc79d981c1462b22a7a2cb0d39725f8c01fc425 before 00738665c875ab34efa7126ea63c9d70b48ee169; from acc79d981c1462b22a7a2cb0d39725f8c01fc425 before 6b471e9aefee9ed73278eb1141e0d8530a56fae9	CNA record

References

https://git.kernel.org/stable/c/958cf3696ddc5ccafd3d0b8b0c03d90bcd771c0c
https://git.kernel.org/stable/c/b4ef30f1d107aae460edf731a7c2d187fbc46a32
https://git.kernel.org/stable/c/1c0a13be76db3c1cf774aa11d9f4c3f8239ac567
https://git.kernel.org/stable/c/00738665c875ab34efa7126ea63c9d70b48ee169
https://git.kernel.org/stable/c/6b471e9aefee9ed73278eb1141e0d8530a56fae9

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.