CVE-2026-90407

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read can occur in the ath11k wmi process csa switch count event() function. This happens because there is no policy entry for WMI TAG PDEV CSA SWITCH COUNT STATUS EVENT, meaning the parse infrastructure does not enforce a minimum length for the event structure. Furthermore, the num vdevs field is retrieved directly from the firmware and used as a loop bound for the vdev ids array without verifying if it fits within the Type-Length-Value (TLV) payload. TLV is a common encoding scheme used to encapsulate data into a format that includes a type identifier and a length indicator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.