Not yet scoredPublished Sep 17, 2026

CVE-2026-92496wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

Updated under an hour ago (Oct 27, 2026, 11:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread. Add an upfront length check before dereferencing skb->data as a wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event() call to preserve the existing trace semantics (tracing the full raw WMI event including the header), unlike the analogous ath12k fix which could use skb_pull_data() directly. Compile tested only.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d5c65159f2895379e11ca13f62feabe93278985d before 20166fd9a4ad15d7eccc63c9dc99680aea6558ef; from d5c65159f2895379e11ca13f62feabe93278985d before 71690d26c1415e816158b45ee354367244c50d4c; from d5c65159f2895379e11ca13f62feabe93278985d before f9726f6d97dca94ab14739c8b632301a940a7e8f; from d5c65159f2895379e11ca13f62feabe93278985d before 2677fc48dd10dc08cdec99c2692d50fe5f48dcbf; from d5c65159f2895379e11ca13f62feabe93278985d before 9652e7e23137538169f60323300cae3413475685; from d5c65159f2895379e11ca13f62feabe93278985d before 72a5e45f606ec454ef556a68ffd92e06b0677f44; from d5c65159f2895379e11ca13f62feabe93278985d before 9ddbc95dac167e3f2d0e3859e6ce022ae0184fc1; from d5c65159f2895379e11ca13f62feabe93278985d before 9ef9dd30058cc9223c72f711dca1a28a5947d0c5	CNA record

References

References

https://git.kernel.org/stable/c/20166fd9a4ad15d7eccc63c9dc99680aea6558ef
https://git.kernel.org/stable/c/71690d26c1415e816158b45ee354367244c50d4c
https://git.kernel.org/stable/c/f9726f6d97dca94ab14739c8b632301a940a7e8f
https://git.kernel.org/stable/c/2677fc48dd10dc08cdec99c2692d50fe5f48dcbf
https://git.kernel.org/stable/c/9652e7e23137538169f60323300cae3413475685
https://git.kernel.org/stable/c/72a5e45f606ec454ef556a68ffd92e06b0677f44
https://git.kernel.org/stable/c/9ddbc95dac167e3f2d0e3859e6ce022ae0184fc1
https://git.kernel.org/stable/c/9ef9dd30058cc9223c72f711dca1a28a5947d0c5

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.