{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-97442", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-97442" ], "published": "2026-09-24T16:08:25Z", "summary": "wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi\n\nIn certain cases, hardware might provide packets with a\nlength greater than the maximum native Wi-Fi header length.\nThis can lead to accessing and modifying fields in the header\nwithin the ath11k_dp_rx_h_undecap_nwifi() function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type and\npotentially result in invalid data access and memory corruption.\n\nKernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k]\nCall trace:\n ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k]\n ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k]\n ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k]\n ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k]\n ath11k_dp_service_srng+0x2e0/0x348 [ath11k]\n\nAdd a sanity check before processing the SKB to prevent invalid\ndata access in the undecap native Wi-Fi function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type.\n\nThis adapted from the discussion/patch of the ath12k driver [1].\n\nTested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.189", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97442" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/958cf3696ddc5ccafd3d0b8b0c03d90bcd771c0c" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/b4ef30f1d107aae460edf731a7c2d187fbc46a32" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/1c0a13be76db3c1cf774aa11d9f4c3f8239ac567" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/00738665c875ab34efa7126ea63c9d70b48ee169" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/6b471e9aefee9ed73278eb1141e0d8530a56fae9" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-10-03T11:04:09Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.8, "cvss_v3_severity": "High", "scenario": "AV:A - The attacker-controlled bytes are the 802.11 frame_control of a native-WiFi MSDU that reaches ath11k_dp_rx_h_undecap_nwifi() via ath11k_pcic_ext_grp_napi_poll/ath11k_ahb_ext_grp_napi_poll \u2192 ath11k_dp_service_srng \u2192 ath11k_dp_rx_process_wbm_err \u2192 ath11k_dp_rx_wbm_err \u2192 ath11k_dp_rx_h_mpdu \u2192 ath11k_dp_rx_h_undecap. That is over-the-air WiFi, not a routable IP protocol.\nAC:L - ieee80211_hdrlen() is a function of frame_control bits the attacker sets. A 4-address QoS data A-MSDU gives hdr_len 32 (36 with Order), which exceeds decap_hdr[DP_MAX_NWIFI_HDR_LEN] (30). ath11k_frame_mode defaults to ATH11K_HW_TXRX_NATIVE_WIFI, and the attacker retransmits until a non-first subframe takes memcpy(decap_hdr, hdr, hdr_len). No uninfluenced device state.\nPR:N - ath11k_dp_rx_h_null_q_desc() handles WBM DESC_ADDR_ZERO MSDUs with no REO peer/TID queue and still calls ath11k_dp_rx_h_mpdu(); a peer miss falls back to the RX-descriptor encrypt type. That NAPI path has no uid or capability check, so an unauthenticated nearby transmitter whose frame passes the hardware RA filter is enough.\nUI:N - Once the ath11k netdev is up, the injected native-WiFi MSDU is processed in NAPI by ath11k_dp_rx_wbm_err or ath11k_dp_rx_process_msdu. No mount, click, pairing, or other victim action is required at trigger time.\nS:U - The overflow is the 30-byte decap_hdr stack array inside ath11k_dp_rx_h_undecap_nwifi() in the host kernel. It does not escape a VM, bypass the IOMMU, or otherwise leave this security authority.\nC:H - After the overflow, memcpy(skb_push(msdu, hdr_len), decap_hdr, hdr_len) copies the extra 2\u20136 bytes plus adjacent kernel stack into the skb that ath11k_dp_rx_deliver_msdu() hands to ieee80211_rx_napi, which may forward it in AP/mesh mode \u2014 a stack-disclosure primitive.\nI:H - In the !is_first_msdu branch, memcpy(decap_hdr, hdr, hdr_len) writes up to 6 attacker-chosen 802.11 header bytes past the 30-byte stack buffer, overwriting adjacent locals, the stack canary, or saved registers \u2014 a controlled OOB write and control-flow hijack primitive.\nA:H - The smash is observed as \"Kernel stack is corrupted in: ath11k_dp_rx_h_undecap\" on the WBM path (ath11k_dp_rx_process_wbm_err \u2192 ath11k_dp_rx_h_mpdu). That trips __stack_chk_fail or FORTIFY_SOURCE, and skb_pull(hdr_len) on a short MSDU hits skb_under_panic." } } }