CVE-2026-92496

wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread.

Add an upfront length check before dereferencing skb->data as a wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event() call to preserve the existing trace semantics (tracing the full raw WMI event including the header), unlike the analogous ath12k fix which could use skb_pull_data() directly.

Compile tested only.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d5c65159f2895379e11ca13f62feabe93278985d to before 20166fd9a4ad15d7eccc63c9dc99680aea6558efAffected d5c65159f2895379e11ca13f62feabe93278985d to before 71690d26c1415e816158b45ee354367244c50d4cAffected d5c65159f2895379e11ca13f62feabe93278985d to before f9726f6d97dca94ab14739c8b632301a940a7e8fAffected d5c65159f2895379e11ca13f62feabe93278985d to before 2677fc48dd10dc08cdec99c2692d50fe5f48dcbfAffected d5c65159f2895379e11ca13f62feabe93278985d to before 9652e7e23137538169f60323300cae3413475685Affected d5c65159f2895379e11ca13f62feabe93278985d to before 72a5e45f606ec454ef556a68ffd92e06b0677f44Affected d5c65159f2895379e11ca13f62feabe93278985d to before 9ddbc95dac167e3f2d0e3859e6ce022ae0184fc1Affected d5c65159f2895379e11ca13f62feabe93278985d to before 9ef9dd30058cc9223c72f711dca1a28a5947d0c5Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

d5c65159f2895379e11ca13f62feabe93278985d to before 20166fd9a4ad15d7eccc63c9dc99680aea6558efAffected
d5c65159f2895379e11ca13f62feabe93278985d to before 71690d26c1415e816158b45ee354367244c50d4cAffected
d5c65159f2895379e11ca13f62feabe93278985d to before f9726f6d97dca94ab14739c8b632301a940a7e8fAffected
d5c65159f2895379e11ca13f62feabe93278985d to before 2677fc48dd10dc08cdec99c2692d50fe5f48dcbfAffected
d5c65159f2895379e11ca13f62feabe93278985d to before 9652e7e23137538169f60323300cae3413475685Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 72a5e45f606ec454ef556a68ffd92e06b0677f44Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 9ddbc95dac167e3f2d0e3859e6ce022ae0184fc1Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 9ef9dd30058cc9223c72f711dca1a28a5947d0c5Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.