The vulnerability in the Linux kernel's ath11k driver arises from a stride mismatch in the mac_phy_caps_parse() function. The function kcalloc() allocates a buffer sized as tot_phy_id * len, where len is clamped to the minimum of firmware_len and the size of struct wmi_mac_phy_capabilities. However, the subsequent memcpy() advances the destination pointer by the full struct size per slot, not by the clamped len. This mismatch leads to out-of-bounds writes when the firmware sends short TLVs, corrupting memory beyond the allocated buffer. The reader function ath11k_pull_mac_phy_cap_svc_ready_ext() also indexes the buffer using full-struct pointer arithmetic, requiring consistent allocation size and stride. The vulnerability was fixed by replacing kcalloc() with kzalloc_objs(), which derives the element size from the pointer type, ensuring allocation size and pointer stride are consistent regardless of firmware-provided len. The fix was compile tested only.

This vulnerability can lead to memory corruption due to out-of-bounds writes when processing malformed or short TLVs from firmware in the ath11k WiFi driver. The CVSS score of 8.4 indicates high severity with potential for confidentiality, integrity, and availability impacts. However, there are no known exploits in the wild at this time.

A fix has been implemented in the Linux kernel source by replacing the allocation method to ensure consistent buffer sizing and prevent out-of-bounds writes. Users should apply the updated Linux kernel version containing this fix once it is released. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and remediation guidance.