CVE-2026-97442

A flaw was found in the Linux kernel's ath11k wireless driver. When processing incoming Wi-Fi frames, the driver fails to properly validate native Wi-Fi header lengths, allowing packets that exceed expected limits to be processed. An attacker within wireless range could exploit this issue by transmitting crafted Wi-Fi frames, triggering invalid memory access and kernel stack corruption. This flaw primarily results in a system crash, causing a Denial of Service (DoS).

A flaw was found in the Linux kernel's ath11k wireless driver, which affects Red Hat Enterprise Linux 8, 9, and 10 (including the kernel-rt variant), Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform. This moderate-impact flaw exists because the ath11k_dp_rx_h_undecap_nwifi() function does not validate that a received packet's native Wi-Fi decapsulation header fits within the maximum expected header length. An attacker within radio range of a system using affected ath11k-based Wi-Fi hardware can transmit crafted Wi-Fi frames with an oversized native Wi-Fi header, causing the driver to access and modify out-of-bounds header data. The resulting memory corruption manifests as kernel stack corruption and a system crash, so the primary impact is denial of service. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernel versions. Fixes for the affected streams are currently deferred: the issue is an input-validation bug in the Wi-Fi receive path whose demonstrated impact is limited to availability, with no evidence of privilege escalation, information disclosure, or controlled data modification, so the fix is planned for delivery via a future scheduled kernel update rather than an immediate out-of-band update; the residual risk is that an adjacent wireless attacker can crash systems equipped with affected ath11k hardware until the fix is applied. Red Hat has rated this flaw as Moderate severity (CVSS 3.1 score of 5.5), which is lower than the Important rating (8.8) in the upstream CVE record; the difference stems from the upstream vector assuming an unauthenticated adjacent attacker with high confidentiality and integrity impact, whereas Red Hat's assessment reflects availability-only impact from the demonstrated kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.