---
id: CVE-2026-92496
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

  Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read
  without first verifying that the buffer…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

  Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read
  without first verifying that the buffer…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    20166fd9a4ad15d7eccc63c9dc99680aea6558ef
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    71690d26c1415e816158b45ee354367244c50d4c
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    f9726f6d97dca94ab14739c8b632301a940a7e8f
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    2677fc48dd10dc08cdec99c2692d50fe5f48dcbf
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    9652e7e23137538169f60323300cae3413475685
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    72a5e45f606ec454ef556a68ffd92e06b0677f44
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    9ddbc95dac167e3f2d0e3859e6ce022ae0184fc1
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    9ef9dd30058cc9223c72f711dca1a28a5947d0c5
  - Linux 5.6
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:51.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92496'
references:
  - url: 'https://git.kernel.org/stable/c/20166fd9a4ad15d7eccc63c9dc99680aea6558ef'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2677fc48dd10dc08cdec99c2692d50fe5f48dcbf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/71690d26c1415e816158b45ee354367244c50d4c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/72a5e45f606ec454ef556a68ffd92e06b0677f44'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9652e7e23137538169f60323300cae3413475685'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9ddbc95dac167e3f2d0e3859e6ce022ae0184fc1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9ef9dd30058cc9223c72f711dca1a28a5947d0c5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f9726f6d97dca94ab14739c8b632301a940a7e8f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.783Z'
epss: 0.0021
epssPercentile: 0.10005
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read
without first verifying that the buffer has enough data to hold a
header. This could result in a buffer overread.

Add an upfront length check before dereferencing skb->data as a
wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event()
call to preserve the existing trace semantics (tracing the full raw
WMI event including the header), unlike the analogous ath12k fix which
could use skb_pull_data() directly.

Compile tested only.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.