CVE-2026-68355

wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()

When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow.

Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d5c65159f2895379e11ca13f62feabe93278985d to before 085a5fde5bac29c01059e69399b417e91c0a6c18Affected d5c65159f2895379e11ca13f62feabe93278985d to before 31ea4b175bc3ab430be15834d9ee8a1ce65bee15Affected d5c65159f2895379e11ca13f62feabe93278985d to before 20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591Affected d5c65159f2895379e11ca13f62feabe93278985d to before 69a6a4f60b2da92c0bdfd9264b8ffe053f51f52aAffected d5c65159f2895379e11ca13f62feabe93278985d to before 904367381a922aa2dc3e8bd2488e6c9180516c7aAffected d5c65159f2895379e11ca13f62feabe93278985d to before a154ca3c441a67d36b3a9ea63a4f11b06abe6223Affected d5c65159f2895379e11ca13f62feabe93278985d to before 725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5Affected d5c65159f2895379e11ca13f62feabe93278985d to before 7f11e70629650ff6ea140984e5ce188b775b2683Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

d5c65159f2895379e11ca13f62feabe93278985d to before 085a5fde5bac29c01059e69399b417e91c0a6c18Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 31ea4b175bc3ab430be15834d9ee8a1ce65bee15Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 69a6a4f60b2da92c0bdfd9264b8ffe053f51f52aAffected
d5c65159f2895379e11ca13f62feabe93278985d to before 904367381a922aa2dc3e8bd2488e6c9180516c7aAffected
d5c65159f2895379e11ca13f62feabe93278985d to before a154ca3c441a67d36b3a9ea63a4f11b06abe6223Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 7f11e70629650ff6ea140984e5ce188b775b2683Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.