CVE-2026-68352wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled. Add a check that the total IE length fits within the buffer.
- CVSS
- 8.3 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bdcd81707973cf8aa9305337166f8ee842a050d4 before 7cae33e3e09a080db96e3a8980c2c8d288318320; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 1eeed9efc9a40e0635e910c37fee86543041b4e1; from bdcd81707973cf8aa9305337166f8ee842a050d4 before a38d7d6376b295245b53bc98b7ca682c027abaf7; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e; from bdcd81707973cf8aa9305337166f8ee842a050d4 before d70c0a850c21b57a6f46ce363860203389bbeaa6; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 33b5342d2080657054ddf89ef1199b426a37dae8; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 94e1bfcefe8264a207c2fda2febb954e70a34b42; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 6b47b29730de3232b919d8362749f6814c5f2a33 | CNA record |
References
- https://git.kernel.org/stable/c/7cae33e3e09a080db96e3a8980c2c8d288318320
- https://git.kernel.org/stable/c/1eeed9efc9a40e0635e910c37fee86543041b4e1
- https://git.kernel.org/stable/c/a38d7d6376b295245b53bc98b7ca682c027abaf7
- https://git.kernel.org/stable/c/1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e
- https://git.kernel.org/stable/c/d70c0a850c21b57a6f46ce363860203389bbeaa6
- https://git.kernel.org/stable/c/33b5342d2080657054ddf89ef1199b426a37dae8
- https://git.kernel.org/stable/c/94e1bfcefe8264a207c2fda2febb954e70a34b42
- https://git.kernel.org/stable/c/6b47b29730de3232b919d8362749f6814c5f2a33
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.