CVE-2026-90399 (GCVE-0-2026-90399)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-09-18 17:55
VLAI
Title
wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() Currently, in ath12k_wmi_mac_phy_caps_parse(), kzalloc() sizes the mac_phy_caps buffer as tot_phy_id * len, where len is clamped to min(firmware_len, sizeof(struct ath12k_wmi_mac_phy_caps_params)). The subsequent memcpy() destination advances by sizeof(full struct) per slot via C pointer arithmetic, not by the clamped len. When firmware sends short TLVs, the second and later slots are written past the end of the allocation. The reader in ath12k_pull_mac_phy_cap_svc_ready_ext() also indexes the buffer with full-struct pointer arithmetic, so the allocation must match that stride. Fix by using kzalloc_objs(), which derives the element size from the pointer type, making allocation size and pointer stride provably consistent regardless of what len the firmware provides. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < d3355e0fdbbf531ca8b82a6a3feb80a1b7306a8b (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < b9a5d12cbdeb860306f8d47c92caee0ea6ee0e0a (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 26f8f87f0a556e7984366c64cebc16d49e15d22f (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 4c6eb712a91fa079be6f9f1419c96e0ad2227081 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d3355e0fdbbf531ca8b82a6a3feb80a1b7306a8b",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "b9a5d12cbdeb860306f8d47c92caee0ea6ee0e0a",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "26f8f87f0a556e7984366c64cebc16d49e15d22f",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "4c6eb712a91fa079be6f9f1419c96e0ad2227081",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix stride mismatch in mac_phy_caps_parse()\n\nCurrently, in ath12k_wmi_mac_phy_caps_parse(), kzalloc() sizes the\nmac_phy_caps buffer as tot_phy_id * len, where len is clamped to\nmin(firmware_len, sizeof(struct ath12k_wmi_mac_phy_caps_params)). The\nsubsequent memcpy() destination advances by sizeof(full struct) per slot\nvia C pointer arithmetic, not by the clamped len. When firmware sends\nshort TLVs, the second and later slots are written past the end of the\nallocation.\n\nThe reader in ath12k_pull_mac_phy_cap_svc_ready_ext() also indexes the\nbuffer with full-struct pointer arithmetic, so the allocation must match\nthat stride.\n\nFix by using kzalloc_objs(), which derives the element size from the\npointer type, making allocation size and pointer stride provably\nconsistent regardless of what len the firmware provides.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed bytes are WMI_TAG_MAC_PHY_CAPABILITIES TLVs inside WMI_SERVICE_READY_EXT_EVENTID, DMA\u0027d from the ath12k firmware Copy Engine (ath12k_ce_recv_process_cb \u2192 ath12k_htc_rx_completion_handler \u2192 ath12k_wmi_op_rx \u2192 ath12k_service_ready_ext_event \u2192 ath12k_wmi_mac_phy_caps_parse). That is PCIe/AHB host-firmware WMI, not an 802.11 frame.\nAC:L - Firmware sets tot_phy_id via fls(phy_id_map) in ath12k_wmi_hw_mode_caps_parse and the TLV length (no min_len for WMI_TAG_MAC_PHY_CAPABILITIES). Any tot_phy_id\u003e=2 with len \u003c sizeof(struct ath12k_wmi_mac_phy_caps_params) makes memcpy of slot 1+ land past the tot_phy_id*len kzalloc; no race or layout lottery.\nPR:N - The CE/HTC WMI receive path has no capable() or authentication check; ath12k_service_ready_ext_event parses whatever firmware posts. A compromised or malicious WCN7850/QCN9274 firmware needs no Linux account.\nUI:N - ath12k_core_start() blocks in ath12k_wmi_wait_for_service_ready() during probe and crash recovery (ath12k_core_reconfigure_on_crash); the overflow runs when that event arrives, with no victim ioctl, mount, or iface config.\nS:U - The GFP_ATOMIC heap overflow is in the host kernel\u0027s mac_phy_caps buffer allocated by ath12k_wmi_mac_phy_caps_parse. Impact stays in that kernel; this is not a KVM/Xen escape or IOMMU DMA-remapping bypass.\nC:H - memcpy writes firmware-chosen payloads at full-struct strides past a short tot_phy_id*len object, and ath12k_wmi_save_all_mac_phy_info()/ath12k_pull_mac_phy_cap_svc_ready_ext() then read that heap with the same stride, giving a high-confidentiality primitive from adjacent objects.\nI:H - Each overflowing slot is an out-of-bounds write of firmware-controlled contents (up to just-under-sizeof(struct ath12k_wmi_mac_phy_caps_params) bytes) into the kernel heap, enabling adjacent-object corruption and control-flow hijack.\nA:H - The same OOB write, and the later full-struct walk of the undersized mac_phy_caps buffer in ath12k_wmi_save_all_mac_phy_info(), can smash heap metadata or adjacent pointers and oops/panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:55:06.735Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d3355e0fdbbf531ca8b82a6a3feb80a1b7306a8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9a5d12cbdeb860306f8d47c92caee0ea6ee0e0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/26f8f87f0a556e7984366c64cebc16d49e15d22f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c6eb712a91fa079be6f9f1419c96e0ad2227081"
        }
      ],
      "title": "wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90399",
    "datePublished": "2026-09-17T16:09:30.273Z",
    "dateReserved": "2026-09-11T19:38:34.811Z",
    "dateUpdated": "2026-09-18T17:55:06.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90399",
      "date": "2026-09-29",
      "epss": "0.00196",
      "percentile": "0.08282"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath12k/wmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d3355e0fdbbf531ca8b82a6a3feb80a1b7306a8b",
                    "status": "affected",
                    "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b9a5d12cbdeb860306f8d47c92caee0ea6ee0e0a",
                    "status": "affected",
                    "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "26f8f87f0a556e7984366c64cebc16d49e15d22f",
                    "status": "affected",
                    "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4c6eb712a91fa079be6f9f1419c96e0ad2227081",
                    "status": "affected",
                    "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath12k/wmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix stride mismatch in mac_phy_caps_parse()\n\nCurrently, in ath12k_wmi_mac_phy_caps_parse(), kzalloc() sizes the\nmac_phy_caps buffer as tot_phy_id * len, where len is clamped to\nmin(firmware_len, sizeof(struct ath12k_wmi_mac_phy_caps_params)). The\nsubsequent memcpy() destination advances by sizeof(full struct) per slot\nvia C pointer arithmetic, not by the clamped len. When firmware sends\nshort TLVs, the second and later slots are written past the end of the\nallocation.\n\nThe reader in ath12k_pull_mac_phy_cap_svc_ready_ext() also indexes the\nbuffer with full-struct pointer arithmetic, so the allocation must match\nthat stride.\n\nFix by using kzalloc_objs(), which derives the element size from the\npointer type, making allocation size and pointer stride provably\nconsistent regardless of what len the firmware provides.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3"
          }
        ],
        "id": "CVE-2026-90399",
        "lastModified": "2026-09-18T18:17:57.220",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:39.643",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/26f8f87f0a556e7984366c64cebc16d49e15d22f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4c6eb712a91fa079be6f9f1419c96e0ad2227081"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b9a5d12cbdeb860306f8d47c92caee0ea6ee0e0a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d3355e0fdbbf531ca8b82a6a3feb80a1b7306a8b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.