From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-90348: wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
Date: Thu, 17 Sep 2026 17:12:58 +0100 [thread overview]
Message-ID: <2026091703-CVE-2026-90348-b295@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
On WCN3990/SNOC the MSA region is mapped with devm_memremap(MEMREMAP_WT).
On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to
it are not permitted. ath10k_msa_dump_memory() copies the region with a
plain memcpy(), whose optimized __pi_memcpy_generic implementation issues
wide/unaligned loads. This triggers an alignment fault (FSC=0x21) Oops in
ath10k_snoc_fw_crashed_dump() while collecting the devcoredump:
Unable to handle kernel paging request ... FSC=0x21: alignment fault
pc : __pi_memcpy_generic
lr : ath10k_snoc_fw_crashed_dump [ath10k_snoc]
The Oops both leaves the firmware RAM dump buffer zeroed (no dump is
captured) and crashes the kernel, which in turn breaks modem SSR
recovery.
Use memcpy_fromio(), which only performs accesses that are valid for such
a device-memory mapping. The generic memcpy_fromio() implementation aligns
the source before issuing word-sized reads and stores the destination with
put_unaligned(), so it is also safe for the coherent DMA allocation used on
the non-reserved-memory path. ath11k and ath12k use the same pattern
when copying target memory into crash dumps, so call it unconditionally
here too.
The MEMREMAP_WT pointer is a plain void *, so an explicit __iomem cast is
needed; use __force to keep sparse happy.
Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.3.7.c5-00107-QCAHLSWMTPL-1
The Linux kernel CVE team has assigned CVE-2026-90348 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 5.10.270 with commit e5bc3658da9c8a535e3fa5c0c875b2a456954e81
Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 5.15.221 with commit fed1f662c9f9fd19eeab6c01966b7b5a33804420
Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 6.1.188 with commit 838cab267ce9a975776e022f25094f8cbe1625d2
Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 6.6.157 with commit eb946595a58decdb4cab1b5f3c972ae66f41f1c8
Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 6.12.110 with commit 152e894e90716163c646d70f86b3afeb70442783
Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 6.18.52 with commit 7039825a7479df637c4f5d546cb0e1cec18cd8e1
Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 7.2.6 with commit 045d1bfb72d2631ab9ec74afa491aa788ebb57aa
Issue introduced in 5.5 with commit 3f14b73c38431a6a1ed24de568e18ed89b7082e2 and fixed in 7.3-rc1 with commit 4f25071afe9218aaae1c63fbf75e229aa6405319
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-90348
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/net/wireless/ath/ath10k/snoc.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/e5bc3658da9c8a535e3fa5c0c875b2a456954e81
https://git.kernel.org/stable/c/fed1f662c9f9fd19eeab6c01966b7b5a33804420
https://git.kernel.org/stable/c/838cab267ce9a975776e022f25094f8cbe1625d2
https://git.kernel.org/stable/c/eb946595a58decdb4cab1b5f3c972ae66f41f1c8
https://git.kernel.org/stable/c/152e894e90716163c646d70f86b3afeb70442783
https://git.kernel.org/stable/c/7039825a7479df637c4f5d546cb0e1cec18cd8e1
https://git.kernel.org/stable/c/045d1bfb72d2631ab9ec74afa491aa788ebb57aa
https://git.kernel.org/stable/c/4f25071afe9218aaae1c63fbf75e229aa6405319
reply other threads:[~2026-09-17 16:27 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026091703-CVE-2026-90348-b295@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.