{"id":28689,"date":"2026-09-25T04:31:35","date_gmt":"2026-09-24T20:31:35","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97442"},"modified":"2026-09-25T04:31:35","modified_gmt":"2026-09-24T20:31:35","slug":"cve-2026-97442","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97442","title":{"rendered":"CVE-2026-97442 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix inv"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi<\/p>\n<p>In certain cases, hardware might provide packets with a<br \/>\nlength greater than the maximum native Wi-Fi header length.<br \/>\nThis can lead to accessing and modifying fields in the header<br \/>\nwithin the ath11k_dp_rx_h_undecap_nwifi() function for the<br \/>\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type and<br \/>\npotentially result in invalid data access and memory corruption.<\/p>\n<p>Kernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0\/0x6b0 [ath11k]<br \/>\nCall trace:<br \/>\n ath11k_dp_rx_h_mpdu+0x0\/0x2e8 [ath11k]<br \/>\n ath11k_dp_rx_h_mpdu+0x1e0\/0x2e8 [ath11k]<br \/>\n ath11k_dp_rx_wbm_err+0x1e0\/0x450 [ath11k]<br \/>\n ath11k_dp_rx_process_wbm_err+0x2fc\/0x460 [ath11k]<br \/>\n ath11k_dp_service_srng+0x2e0\/0x348 [ath11k]<\/p>\n<p>Add a sanity check before processing the SKB to prevent invalid<br \/>\ndata access in the undecap native Wi-Fi function for the<br \/>\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type.<\/p>\n<p>This adapted from the discussion\/patch of the ath12k driver [1].<\/p>\n<p>Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi<\/p>\n<p>In certain cases, hardware might provide packets with a<br \/>\nleng<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28689","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28689","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28689"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28689"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28689"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}