Linux Kernel CVE-2026-90408

Requires an active ath12k (Qualcomm WiFi 7) driver instance processing a WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT whose num_vdevs field or TLV payload is malformed/oversized relative to the actual buffer. Because num_vdevs and the event data originate from the device firmware, practical exploitation requires control over the firmware image or the host↔firmware WMI event channel (compromised/malicious firmware or a privileged local position), not a plain remote network frame. Limiting factors: applies only to systems with ath12k hardware and driver loaded (kernels ~6.3 onward before the fix), affects niche WiFi 7 chipsets, and yields a read/crash rather than code execution. Fixed in 7.2.6 and 7.3-rc1.

This is a genuine memory-safety bug (out-of-bounds read in ath12k_wmi_process_csa_switch_count_event) but a low-priority one in real-world terms. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:H, 7.7) internally conflicts with the described trigger: the vector claims network-independent local access with no privileges, yet the out-of-bounds condition is driven by a malformed/oversized WMI event delivered by the Wi-Fi firmware (num_vdevs taken directly from firmware and a missing TLV policy entry), not by a conventional local user syscall path. That trigger is not attacker-controllable without a compromised/malicious firmware image or a MITM on the firmware/host WMI channel, which materially raises real attack complexity above the stated AC:L. The impact is also overstated: an OOB read of the vdev_ids array past the TLV payload is crash/DoS-primary (A:H is defensible) with at most marginal information disclosure, so C:H is not well supported - C:N/I:N is more accurate. There is no EPSS score, no CISA KEV listing, and no public PoC (the change is explicitly compile-tested only), so all exploitation-probability signals point to negligible near-term risk. Net: a real defensive-hardening fix, but a high-CVSS-but-low-real-risk item, my adjusted severity ~4.0-4.5.

A Qualcomm ath12k (WiFi 7 / WCN7850-class) adapter receives or is fed a crafted WMI PDEV_CSA_SWITCH_COUNT_STATUS event whose num_vdevs value or truncated TLV payload exceeds the actual buffer. The driver loops over vdev_ids using the unchecked firmware-supplied count, reading past the allocated TLV data and causing a kernel out-of-bounds read (oops/crash). No public exploit code exists; the fix is compile-tested only, and triggering realistically requires control over the firmware/WMI event stream rather than a remote network packet.