CVE-2026-89524

wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

State: Published
Severity: 8.1 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx() bounds the declared lengths from above (their sum must fit the received event), but an assoc request/response shorter than its fixed offset still underflows here: the u8 wraps to ~250, and cfg80211_connect_result() / cfg80211_roamed() then treat that wrapped value as the IE length and copy that many bytes out of the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory.

Clamp both lengths to their offsets before subtracting.

Found by 0sec (https://0sec.ai) using automated source analysis; the missing lower bound is evident from source. Compile-tested.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bdcd81707973cf8aa9305337166f8ee842a050d4 to before 225587bdbf4b0eb5265a71ee4dc183561a1857fcAffected bdcd81707973cf8aa9305337166f8ee842a050d4 to before d337213a889705a69735079606d0b4c672b17605Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before e11d5ae96d5e52cb48fa27c6ad352d766d0322fbAffected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before e3619bed5da125713b29ac881dc66f5e06606f88Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before e1330d719c047c4d8190a16be034b29fc601a815Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 8eb73016fb3968cf2db3987a92764563a3af773aAffected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 3bbd05723d15dd06f0560bcd94fbf9a91b5f5613Affected
LinuxLinux	3.2Affected before 3.2Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

bdcd81707973cf8aa9305337166f8ee842a050d4 to before 225587bdbf4b0eb5265a71ee4dc183561a1857fcAffected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before d337213a889705a69735079606d0b4c672b17605Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before e11d5ae96d5e52cb48fa27c6ad352d766d0322fbAffected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before e3619bed5da125713b29ac881dc66f5e06606f88Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before e1330d719c047c4d8190a16be034b29fc601a815Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 8eb73016fb3968cf2db3987a92764563a3af773aAffected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 3bbd05723d15dd06f0560bcd94fbf9a91b5f5613Affected

LinuxLinux

3.2Affected
before 3.2Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.