PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-90348 Linux CVE debrief

The Linux kernel has a vulnerability in the wifi: ath10k: snoc module, where using memcpy_fromio() for MSA ramdump resolves an alignment fault issue. This fault occurs because the MSA region is mapped with devm_memremap(MEMREMAP_WT) on WCN3990/SNOC, which on arm64 is not Normal-cacheable, thus unaligned accesses are not permitted. The original memcpy() function used in ath10k_msa_dump_memory() causes an alignment fault due to its optimized implementation issuing wide/unaligned loads. This results in a kernel crash and prevents the capture of firmware RAM dump buffer, affecting modem SSR recovery.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-17
Original CVE updated
2026-10-19
Advisory published
2026-09-17
Advisory updated
2026-10-19

Who should care

Defenders responsible for Linux kernel maintenance, wifi: ath10k: snoc module management, and modem SSR recovery processes should assess exposure and apply patches. Linux kernel developers and maintainers should verify and integrate the fix.

Why it matters

CVE-2026-90348 is significant for defenders as it involves a vulnerability in the Linux kernel's wifi: ath10k: snoc module. The issue causes alignment faults on arm64 architectures due to improper use of memcpy() for MSA ramdump. Defenders should verify exposure, apply patches using memcpy_fromio(), and monitor for issues in firmware RAM dump buffer capture and modem SSR recovery.

  • Verify if Linux kernel versions are affected and apply patches
  • Ensure memcpy_fromio() is used for MSA ramdump
  • Monitor for firmware RAM dump buffer capture issues
  • Assess impact on modem SSR recovery

Technical summary

The Linux kernel vulnerability CVE-2026-90348 involves an alignment fault issue in the wifi: ath10k: snoc module. The fault is caused by the use of memcpy() for MSA ramdump, which is not suitable for the device-memory mapping on arm64 architectures. The resolution is to use memcpy_fromio(), ensuring valid accesses for such mappings. This change prevents kernel crashes and allows for the capture of firmware RAM dump buffers, affecting modem SSR recovery. Defenders should verify if their Linux kernel versions are affected and apply patches to use memcpy_fromio() for MSA ramdump in the wifi: ath10k: snoc module.

Defensive priority

Defenders should prioritize verifying if their Linux kernel versions are affected and apply patches to use memcpy_fromio() for MSA ramdump in the wifi: ath10k: snoc module.

Recommended defensive actions

  • Verify Linux kernel versions for potential exposure
  • Apply patches for memcpy_fromio() in wifi: ath10k: snoc
  • Monitor for firmware RAM dump buffer capture issues
  • Assess impact on modem SSR recovery
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability and its resolution. The issue arises from improper use of memcpy() for MSA ramdump, leading to alignment faults on arm64 architectures. The fix involves replacing memcpy() with memcpy_fromio().

Sources and references

Verified primary and authoritative sources

  • CVE-2026-90348 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-90348

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-90348 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-90348

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90348.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e5bc3658da9c8a535e3fa5c0c875b2a456954e81

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fed1f662c9f9fd19eeab6c01966b7b5a33804420

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/838cab267ce9a975776e022f25094f8cbe1625d2

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/eb946595a58decdb4cab1b5f3c972ae66f41f1c8

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/152e894e90716163c646d70f86b3afeb70442783

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7039825a7479df637c4f5d546cb0e1cec18cd8e1

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/045d1bfb72d2631ab9ec74afa491aa788ebb57aa

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.