CVE-2026-90407 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, users of Linux systems with ath11k-based WiFi devices, and security teams responsible for vulnerability management in Linux environments.

Why it matters

This vulnerability in the Linux kernel's ath11k component could lead to out-of-bounds reads when processing certain events from firmware. While a fix has been implemented, Linux kernel maintainers, distribution maintainers, and users of affected systems should assess exposure and apply patches to prevent potential issues. The impact is considered High due to the potential for data corruption or system crashes.

• Verification of Linux kernel patch deployment to prevent potential out-of-bounds reads.
• Assessment of exposure for Linux systems utilizing ath11k-based WiFi devices.
• Monitoring for potential firmware-related issues in Linux kernel environments.

Technical summary

The Linux kernel's ath11k component had a vulnerability where an out-of-bounds read could occur due to insufficient validation of event structure lengths from firmware. This was caused by a missing policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and improper use of the num_vdevs field as a loop bound. The fix adds a TLV policy entry and a helper function to safely bound num_vdevs, addressing potential data corruption or system crashes in Linux environments utilizing ath11k-based WiFi devices. Linux kernel maintainers, distribution maintainers, and users of affected systems should assess exposure and apply patches to prevent potential issues.

Defensive priority

High priority for Linux kernel maintainers and users, especially those utilizing ath11k-based WiFi devices, to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure of Linux kernel deployments using ath11k-based WiFi devices.
• Verify and apply patches from official Linux kernel sources.
• Monitor Linux kernel updates for related security fixes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and associated sources indicate a fix has been implemented in the Linux kernel to address the out-of-bounds read vulnerability in ath11k. Multiple source references are provided, including links to specific kernel commits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.