---
cve: "CVE-2026-90407"
severity: "HIGH"
cvss: 7.7
epss: "0.2%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-17 17:17:40"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-20T18:45:40+02:00"
---

# CVE-2026-90407

> 7.7 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()

There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so
the parse infrastructure does not enforce a minimum length for the event
struct. Additionally, the num_vdevs field is taken directly from firmware
and used as a loop bound over the vdev_ids array without checking that it
fits within the TLV payload. Either condition can cause an out-of-bounds
read.

Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so
the parse infrastructure enforces a minimum length for the fixed-size event
struct. Add a helper ath11k_wmi_tlv_data_len() to recover the payload
length of a parsed TLV from the header preceding its data pointer. Use it
in ath11k_wmi_process_csa_switch_count_event() to bound num_vdevs before
the loop.

Compile tested only.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Keine | good |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 6.6.157
- Kernel ≥ 6.12.110
- Kernel ≥ 6.18.52
- Kernel ≥ 7.2.6

## Referenzen

- <https://git.kernel.org/stable/c/f760b7d7e43584d2fa9bffcec1a04e502609f827>
- <https://git.kernel.org/stable/c/d6625dc5f1fe42cd81b8c57a1f5317afb9b410ce>
- <https://git.kernel.org/stable/c/0364926fb4bfb5b798e5fe2785b3023b4f767327>
- <https://git.kernel.org/stable/c/5de2b8c53714ad58f2fda118cd29ebbe31b38665>
- <https://git.kernel.org/stable/c/208d7fdb85976a737a715b81d54efaff6703880c>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-90407) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_