CVE-2026-90408

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read can occur in the ath12k wmi process csa switch count event() function. This is caused by the absence of a policy entry for WMI TAG PDEV CSA SWITCH COUNT STATUS EVENT, which prevents the parse infrastructure from enforcing a minimum length for the event structure. Furthermore, the num vdevs variable is retrieved directly from the firmware and used as a loop bound for the vdev ids array without verifying if it fits within the Type-Length-Value (TLV) payload. TLV is a common encoding scheme used to encapsulate data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.