CVE-2026-97442

wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi

State: Published
Severity: 8.8 High
Published: Sep 24, 2026
Updated: Oct 3, 2026
Reserved: Sep 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi

In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields in the header within the ath11k_dp_rx_h_undecap_nwifi() function for the DP_RX_DECAP_TYPE_NATIVE_WIFI decap type and potentially result in invalid data access and memory corruption.

Kernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k] Call trace: ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k] ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k] ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k] ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k] ath11k_dp_service_srng+0x2e0/0x348 [ath11k]

Add a sanity check before processing the SKB to prevent invalid data access in the undecap native Wi-Fi function for the DP_RX_DECAP_TYPE_NATIVE_WIFI decap type.

This adapted from the discussion/patch of the ath12k driver [1].

Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before 958cf3696ddc5ccafd3d0b8b0c03d90bcd771c0cAffected acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before b4ef30f1d107aae460edf731a7c2d187fbc46a32Affected acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before 1c0a13be76db3c1cf774aa11d9f4c3f8239ac567Affected acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before 00738665c875ab34efa7126ea63c9d70b48ee169Affected acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before 6b471e9aefee9ed73278eb1141e0d8530a56fae9Affected
LinuxLinux	5.7Affected before 5.7Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before 958cf3696ddc5ccafd3d0b8b0c03d90bcd771c0cAffected
acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before b4ef30f1d107aae460edf731a7c2d187fbc46a32Affected
acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before 1c0a13be76db3c1cf774aa11d9f4c3f8239ac567Affected
acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before 00738665c875ab34efa7126ea63c9d70b48ee169Affected
acc79d981c1462b22a7a2cb0d39725f8c01fc425 to before 6b471e9aefee9ed73278eb1141e0d8530a56fae9Affected

LinuxLinux

5.7Affected
before 5.7Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.