CVE-2026-92496

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread. Add an upfront length check before dereferencing skb->data as a wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event() call to preserve the existing trace semantics (tracing the full raw WMI event including the header), unlike the analogous ath12k fix which could use skb_pull_data() directly. Compile tested only.

Is your site exposed to CVE-2026-92496?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0021

Probability of exploitation

0.11%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/20166fd9a4ad15d7eccc63c9dc99680aea6558ef https://git.kernel.org/stable/c/2677fc48dd10dc08cdec99c2692d50fe5f48dcbf https://git.kernel.org/stable/c/71690d26c1415e816158b45ee354367244c50d4c https://git.kernel.org/stable/c/72a5e45f606ec454ef556a68ffd92e06b0677f44 https://git.kernel.org/stable/c/9652e7e23137538169f60323300cae3413475685 https://git.kernel.org/stable/c/9ddbc95dac167e3f2d0e3859e6ce022ae0184fc1 https://git.kernel.org/stable/c/9ef9dd30058cc9223c72f711dca1a28a5947d0c5 https://git.kernel.org/stable/c/f9726f6d97dca94ab14739c8b632301a940a7e8f

Frequently Asked Questions

What is CVE-2026-92496? +

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() Currently, in ath11k_wmi_tlv_op_rx(), the firmware buffer is read without first verifying that the buffer has enough data to hold a header. This could result in a buffer overread. Add an upfront length check before dereferencing skb->data as a wmi_cmd_hdr. The check is placed before the trace_ath11k_wmi_event() call to preserve the existing trace semantics (tracing the full raw WMI event including the header), unlike the analogous ath12k fix which could use skb_pull_data() directly. Compile tested only.

How do I check if I'm vulnerable to CVE-2026-92496? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.