CVE-2026-90398

A flaw was found in the Linux kernel ath11k Wi-Fi driver. This vulnerability occurs in the mac_phy_caps_parse() function due to a mismatch between the allocated memory size and the size used for copying data. When processing certain firmware messages, the driver attempts to write information beyond the intended memory boundary. This out-of-bounds write can lead to memory corruption within the kernel.

A heap out of bounds write can occur in ath11k mac_phy_caps parsing because the allocation size used the firmware provided TLV length while later accesses used the full struct wmi_mac_phy_capabilities pointer stride. If a short firmware TLV is accepted, the second and later mac_phy_caps slots are written beyond the allocated buffer during memcpy. This is kernel memory corruption rather than a simple warning or resource leak. For the CVSS the PR:N is used in the paranoid score only for the malicious device or firmware controlled input case where no host user account is required. The issue is not proven to be directly reachable from ordinary WiFi network traffic because the malformed input is a firmware WMI service ready TLV. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to controlled heap corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.