CVE-2026-90407

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()

There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so

the parse infrastructure does not enforce a minimum length for the event

struct. Additionally, the num_vdevs field is taken directly from firmware

and used as a loop bound over the vdev_ids array without checking that it

fits within the TLV payload. Either condition can cause an out-of-bounds

read.

Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so

the parse infrastructure enforces a minimum length for the fixed-size event

struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload

length of a parsed TLV from the header preceding its data pointer. Use it

in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before

the loop.

Compile tested only.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References