CVE-2026-68353

Summary

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler

The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg.

Add a check that the buffer is large enough to hold the fixed struct and the num_msg variable-length entries.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < 69ac7ba3a3df6654e7daa82674575a8c4a1a63eaaffected
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < 289edc3c71344b89e6522891147cfb8f61b088bbaffected
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < eb636fbc443149b3501c3f97e26225ddcb314a0faffected
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < c38b0d5c661951b5dd082bdf31f8a57a0ce6e540affected
LinuxLinuxbdcd81707973cf8aa9305337166f8ee842a050d4 < 3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495affected
LinuxLinux3.2affected
LinuxLinux0 < 3.2unaffected
LinuxLinux6.6.148 <= 6.6.*unaffected
LinuxLinux6.12.101 <= 6.12.*unaffected
LinuxLinux6.18.42 <= 6.18.*unaffected
LinuxLinux7.1.6 <= 7.1.*unaffected
LinuxLinux7.2-rc5 <= *unaffected

Weaknesses

References