CVE-2026-68352

HIGH 8.3

wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

CVSS Score

8.3

EPSS Score

0.0%

EPSS Percentile

0th

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled. Add a check that the total IE length fits within the buffer.

Vendor	linux
Product	linux
Ecosystems	Linux Kernel
Industries	Technology
Published	Aug 10, 2026
Last Updated	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for linux linux

Be the first to know when new high vulnerabilities affecting linux linux are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Linux / Linux

bdcd81707973cf8aa9305337166f8ee842a050d4 < 7cae33e3e09a080db96e3a8980c2c8d288318320 bdcd81707973cf8aa9305337166f8ee842a050d4 < 1eeed9efc9a40e0635e910c37fee86543041b4e1 bdcd81707973cf8aa9305337166f8ee842a050d4 < a38d7d6376b295245b53bc98b7ca682c027abaf7 bdcd81707973cf8aa9305337166f8ee842a050d4 < 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e bdcd81707973cf8aa9305337166f8ee842a050d4 < d70c0a850c21b57a6f46ce363860203389bbeaa6 bdcd81707973cf8aa9305337166f8ee842a050d4 < 33b5342d2080657054ddf89ef1199b426a37dae8 bdcd81707973cf8aa9305337166f8ee842a050d4 < 94e1bfcefe8264a207c2fda2febb954e70a34b42 bdcd81707973cf8aa9305337166f8ee842a050d4 < 6b47b29730de3232b919d8362749f6814c5f2a33

Linux / Linux

3.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗