CVE-2026-90408

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This vulnerability arises from insufficient length enforcement for event structures and unchecked firmware input used as loop bounds. An attacker could potentially exploit this to cause an out-of-bounds read, which may lead to information disclosure or a denial of service.

This vulnerability is rated as Moderate because exploitation requires the presence of Qualcomm Wi-Fi 7 hardware managed by the ath12k driver, which is uncommon in enterprise server deployments. The flaw is confined to the processing of firmware events within this wireless subsystem, limiting the blast radius to a local denial of service or read-only memory exposure without permitting arbitrary code execution across the host. Systems without ath12k-compatible network hardware or where the driver module is unutilized remain unaffected in practice.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.