Linux Kernel Wi-Fi subsystem Vulnerability Rated 7.7 CVSS

Last refreshed2026-10-15

Status: UPDATED | Advisory ID: CVE-2026-90408

Key Details

CVE	CVE-2026-90408
CVSS Score / Version	7.7 (High) / CVSS v3.1
Updated	2026-10-15
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is none; availability impact is high.
Affected products	Linux Kernel
Exploitation prediction (EPSS)	0.18% probability of exploitation in the next 30 days (7% percentile) -- FIRST.org's EPSS model.

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()

There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so

the parse infrastructure does not enforce a minimum length for the event

struct. Additionally, the num_vdevs field is taken directly from firmware

and used as a loop bound over the vdev_ids array without checking that it

fits within the TLV payload. Either condition can cause an out-of-bounds

read.

Add a TLV policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT so

the parse infrastructure enforces a minimum length for the fixed-size event

struct. Add a helper ath12k_wmi_tlv_data_len() to recover the payload

length of a parsed TLV from the header preceding its data pointer. Use it

in ath12k_wmi_process_csa_switch_count_event() to bound num_vdevs before

the loop.

Compile tested only. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-90408
CVE	https://www.cve.org/CVERecord?id=CVE-2026-90408

Source

Reference

NVD

CVE