{"cve":"CVE-2026-90408","nvd":{"published":"2026-09-17T17:17:40.700","modified":"2026-10-21T13:20:54.057","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()\n\nThere is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so\nthe parse infrastructure does not enforce a minimum length for the event\nstruct. Additionally, the num_vdevs field is taken directly from firmware\nand used as a loop bound over the vdev_ids array without checking that it\nfits within the TLV payload. Either condition can cause an out-of-bounds\nread.\n\nAdd a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so\nthe parse infrastructure enforces a minimum length for the fixed-size event\nstruct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload\nlength of a parsed TLV from the header preceding its data pointer. Use it\nin ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before\nthe loop.\n\nCompile tested only.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":7.7},"cwes":[],"references":["https://git.kernel.org/stable/c/23bed4ef132c55c9016f0c6122c8b8ba2efa2353","https://git.kernel.org/stable/c/24f7cdabea9f7ab95dbd6d8bc9ac6ec48d96a7e5","https://git.kernel.org/stable/c/878654eb78c6aa0ff585baf1376567c775ca28ec","https://git.kernel.org/stable/c/bf97c9d5123859a07848462539153176db029f3a","https://git.kernel.org/stable/c/d4aec20f3a84634171c139ab2e02bb2e5a5c756b"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-90408","score":0.0019,"percentile":0.08617,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}