A heap-based buffer overflow in the Linux kernel ath11k driver could allow a local attacker to achieve code execution or system compromise.

The vulnerability occurs in the ath11k_wmi_tlv_mac_phy_caps_parse function where an incorrect buffer allocation size causes subsequent memory operations to write data beyond the allocated heap space. This flaw is triggered when the firmware provides short Type-Length-Value (TLV) structures, leading to an out-of-bounds write.

The vulnerability carries a CVSS score of 8.4, indicating high severity. Successful exploitation could result in a complete system compromise, unauthorized data access, or a kernel panic leading to denial of service. Because the flaw resides within the kernel, the impact is severe, potentially allowing an attacker to escalate privileges or bypass security boundaries.

Immediate Action: Update the Linux kernel to version 6.12.110, 6.18.52, 7.2.6, or a later stable release where this issue has been addressed.

Proactive Monitoring: Monitor system logs for kernel-related faults, segmentation violations, or unexpected system crashes that may indicate memory corruption.

Compensating Controls: Restrict hardware access to authorized users and implement kernel hardening measures, such as Address Space Layout Randomization (ASLR) and stack protection, to increase the difficulty of exploit development.

Public Exploit Available: Unknown

Given the potential for high-impact compromise within the kernel, administrators should prioritize applying the provided kernel patches. Organizations using affected ath11k-based wireless hardware should verify their kernel versions against the fixed releases and schedule maintenance to apply the necessary security updates as soon as possible.