CVE-2026-68196: wifi: wilc1000: validate assoc response length before subtracting header

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: validate assoc response length before subtracting header

wilcparseassocrespinfo() computes the trailing IE length as

ieslen = bufferlen - sizeof(res);

without first checking that bufferlen is at least sizeof(struct wilcassocresp) (6 bytes). bufferlen is the length reported for a received association response (hostintparseassocrespinfo() passes hifdrv->assocresp / assocrespinfolen straight in) and must be validated before the driver accesses the fixed header.

For a frame shorter than the 6-byte fixed header, the subtraction wraps. For a four-byte response the result is truncated to a u16 ieslen of 65534, so kmemdup() then attempts to copy 65534 bytes starting at buffer + sizeof(res), beyond the valid association-response data (CWE-125). A response shorter than four bytes can also cause an out-of-bounds read of res->statuscode at offsets 2 and 3.

Reject frames too short to hold the fixed header before touching the header or computing ieslen. Also set the connection status to a failure on this path: the caller falls through to a "conninfo->status == WLANSTATUSSUCCESS" check after the parser returns, so leaving the status untouched could let a malformed short response be treated as a successful association.