CVE-2026-68352

wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

State: Published
Severity: 8.3 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled.

Add a check that the total IE length fits within the buffer.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	bdcd81707973cf8aa9305337166f8ee842a050d4 to before 7cae33e3e09a080db96e3a8980c2c8d288318320Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 1eeed9efc9a40e0635e910c37fee86543041b4e1Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before a38d7d6376b295245b53bc98b7ca682c027abaf7Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5eAffected bdcd81707973cf8aa9305337166f8ee842a050d4 to before d70c0a850c21b57a6f46ce363860203389bbeaa6Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 33b5342d2080657054ddf89ef1199b426a37dae8Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 94e1bfcefe8264a207c2fda2febb954e70a34b42Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 6b47b29730de3232b919d8362749f6814c5f2a33Affected
LinuxLinux	3.2Affected before 3.2Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

bdcd81707973cf8aa9305337166f8ee842a050d4 to before 7cae33e3e09a080db96e3a8980c2c8d288318320Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 1eeed9efc9a40e0635e910c37fee86543041b4e1Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before a38d7d6376b295245b53bc98b7ca682c027abaf7Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5eAffected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before d70c0a850c21b57a6f46ce363860203389bbeaa6Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 33b5342d2080657054ddf89ef1199b426a37dae8Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 94e1bfcefe8264a207c2fda2febb954e70a34b42Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 6b47b29730de3232b919d8362749f6814c5f2a33Affected

LinuxLinux

3.2Affected
before 3.2Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.