CVE-2026-68353wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg. Add a check that the buffer is large enough to hold the fixed struct and the num_msg variable-length entries.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bdcd81707973cf8aa9305337166f8ee842a050d4 before 5297299c3fa6133275db0be99d69cd759b6cbfe9; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 35196a07603f8c94a4943093bc26d5b5826285f8; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 0e0fc04af9b443c6b425f00fb604ff599bc80d1d; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 69ac7ba3a3df6654e7daa82674575a8c4a1a63ea; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 289edc3c71344b89e6522891147cfb8f61b088bb; from bdcd81707973cf8aa9305337166f8ee842a050d4 before eb636fbc443149b3501c3f97e26225ddcb314a0f; from bdcd81707973cf8aa9305337166f8ee842a050d4 before c38b0d5c661951b5dd082bdf31f8a57a0ce6e540; from bdcd81707973cf8aa9305337166f8ee842a050d4 before 3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495 | CNA record |
References
- https://git.kernel.org/stable/c/5297299c3fa6133275db0be99d69cd759b6cbfe9
- https://git.kernel.org/stable/c/35196a07603f8c94a4943093bc26d5b5826285f8
- https://git.kernel.org/stable/c/0e0fc04af9b443c6b425f00fb604ff599bc80d1d
- https://git.kernel.org/stable/c/69ac7ba3a3df6654e7daa82674575a8c4a1a63ea
- https://git.kernel.org/stable/c/289edc3c71344b89e6522891147cfb8f61b088bb
- https://git.kernel.org/stable/c/eb636fbc443149b3501c3f97e26225ddcb314a0f
- https://git.kernel.org/stable/c/c38b0d5c661951b5dd082bdf31f8a57a0ce6e540
- https://git.kernel.org/stable/c/3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.