CVE-2026-68352

Summary

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled.

Add a check that the total IE length fits within the buffer.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5eaffected
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < d70c0a850c21b57a6f46ce363860203389bbeaa6affected
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < 33b5342d2080657054ddf89ef1199b426a37dae8affected
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < 94e1bfcefe8264a207c2fda2febb954e70a34b42affected
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < 6b47b29730de3232b919d8362749f6814c5f2a33affected
LinuxLinux3.2affected
LinuxLinux0 < 3.2unaffected
LinuxLinux6.6.148 <= 6.6.*unaffected
LinuxLinux6.12.101 <= 6.12.*unaffected
LinuxLinux6.18.42 <= 6.18.*unaffected
LinuxLinux7.1.6 <= 7.1.*unaffected
LinuxLinux7.2-rc5 <= *unaffected

Weaknesses

References