CVE-2026-90399

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This vulnerability stems from incorrect memory handling within the mac_phy_caps_parse() function. When processing certain data packets from firmware, specifically short Type-Length-Value (TLV) structures, the driver attempts to write more data than the allocated memory buffer can hold. This out-of-bounds write can corrupt system memory, potentially leading to system instability or a denial of service.

An OOB write in ath12k WMI mac_phy_caps_parse can occur when firmware sends short mac phy capability TLVs. The buffer was allocated using tot_phy_id multiplied by a clamped TLV length, while later slots are addressed using full struct pointer stride, so the second and later entries can be copied past the allocation. For the CVSS the PR:N value is used for the paranoid hardware or firmware controlled scenario, because a malicious or compromised device can provide malformed WMI TLVs without a host user account. The issue is not normally reachable from ordinary Wi-Fi network traffic and practical exploitation usually requires control of firmware, a malicious device, or a privileged path that can alter firmware behavior. Impact is kernel memory corruption with at least denial of service and a plausible worst case of confidentiality and integrity impact if the overflow is made controllable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.