Linux ath11k driver EUVD-2026-86055

Requires the ath11k driver to be active on a supported Qualcomm Wi-Fi adapter (tested on WCN6855 hw2.1 PCI) AND operating in the DP_RX_DECAP_TYPE_NATIVE_WIFI receive-decapsulation mode; the trigger is a received packet whose length exceeds the maximum native Wi-Fi header length, which per the description originates from the hardware/RX path and can plausibly be induced by a malformed over-the-air frame. Limiting factors: attacker must be adjacent (over the radio, AV:A) rather than remote across the internet; the specific native-wifi decap path must be in use; and observed impact is kernel stack corruption (crash) with no confirmed path to code execution. No authentication (PR:N) or user interaction (UI:N) is required per the CVSS vector.

The NVD/Linux base score of 8.8 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk. This is a receive-path memory-safety bug in the ath11k driver: 'in certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length,' triggering out-of-bounds header access and confirmed kernel stack corruption. The symptom evidence (KASAN-style stack corruption trace through ath11k_dp_rx_h_mpdu/wbm_err) indicates a crash-dominant DoS outcome rather than a demonstrated confidentiality/integrity compromise, so C:H/I:H/A:H (full RCE-grade impact) is not substantiated by the description. AC:L is also questionable: exploitation requires the driver to be operating in DP_RX_DECAP_TYPE_NATIVE_WIFI decap mode AND an over-length/malformed frame reaching that path, which is closer to AC:H. No EPSS score, no CISA KEV listing, and no public exploit are present in the input - no public exploit identified at time of analysis. Net: a legitimate memory-corruption fix worth patching on affected Qualcomm-WiFi hosts, but NOT a widespread-exploitation emergency; realistic impact is device/kernel crash. Verify true impact ceiling with the vendor - stack corruption is theoretically escalatable, but nothing here confirms code execution.

An attacker within radio range (or a malicious/compromised access point) transmits crafted 802.11 frames to a host whose ath11k adapter uses native Wi-Fi decapsulation; the hardware hands the driver a frame longer than the maximum native Wi-Fi header, and ath11k_dp_rx_h_undecap_nwifi() reads/writes header fields past the buffer, corrupting the kernel stack and crashing the system. No authentication or user interaction is required, but no public exploit code exists and the outcome observed is kernel stack corruption (denial of service) rather than proven code execution.