CVE-2026-97442

A flaw was found in the Linux kernel's ath11k wireless driver, which affects Red Hat Enterprise Linux 8, 9, and 10 (including the kernel-rt variant), Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform. This moderate-impact flaw exists because the ath11k_dp_rx_h_undecap_nwifi() function does not validate that a received packet's native Wi-Fi decapsulation header fits within the maximum expected header length. An attacker within radio range of a system using affected ath11k-based Wi-Fi hardware can transmit crafted Wi-Fi frames with an oversized native Wi-Fi header, causing the driver to access and modify out-of-bounds header data. The resulting memory corruption manifests as kernel stack corruption and a system crash, so the primary impact is denial of service. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernel versions. Fixes for the affected streams are currently deferred: the issue is an input-validation bug in the Wi-Fi receive path whose demonstrated impact is limited to availability, with no evidence of privilege escalation, information disclosure, or controlled data modification, so the fix is planned for delivery via a future scheduled kernel update rather than an immediate out-of-band update; the residual risk is that an adjacent wireless attacker can crash systems equipped with affected ath11k hardware until the fix is applied. Red Hat has rated this flaw as Moderate severity (CVSS 3.1 score of 5.5), which is lower than the Important rating (8.8) in the upstream CVE record; the difference stems from the upstream vector assuming an unauthenticated adjacent attacker with high confidentiality and integrity impact, whereas Red Hat's assessment reflects availability-only impact from the demonstrated kernel crash.