CVE-2026-68355wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow. Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d5c65159f2895379e11ca13f62feabe93278985d before 085a5fde5bac29c01059e69399b417e91c0a6c18; from d5c65159f2895379e11ca13f62feabe93278985d before 31ea4b175bc3ab430be15834d9ee8a1ce65bee15; from d5c65159f2895379e11ca13f62feabe93278985d before 20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591; from d5c65159f2895379e11ca13f62feabe93278985d before 69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a; from d5c65159f2895379e11ca13f62feabe93278985d before 904367381a922aa2dc3e8bd2488e6c9180516c7a; from d5c65159f2895379e11ca13f62feabe93278985d before a154ca3c441a67d36b3a9ea63a4f11b06abe6223; from d5c65159f2895379e11ca13f62feabe93278985d before 725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5; from d5c65159f2895379e11ca13f62feabe93278985d before 7f11e70629650ff6ea140984e5ce188b775b2683 | CNA record |
References
- https://git.kernel.org/stable/c/085a5fde5bac29c01059e69399b417e91c0a6c18
- https://git.kernel.org/stable/c/31ea4b175bc3ab430be15834d9ee8a1ce65bee15
- https://git.kernel.org/stable/c/20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591
- https://git.kernel.org/stable/c/69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a
- https://git.kernel.org/stable/c/904367381a922aa2dc3e8bd2488e6c9180516c7a
- https://git.kernel.org/stable/c/a154ca3c441a67d36b3a9ea63a4f11b06abe6223
- https://git.kernel.org/stable/c/725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5
- https://git.kernel.org/stable/c/7f11e70629650ff6ea140984e5ce188b775b2683
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.