CVE-2026-68352: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->iswmmenabled.
Add a check that the total IE length fits within the buffer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68352?
The severity of CVE-2026-68352 is rated at 27, indicating a significant risk level.
How do I fix CVE-2026-68352?
To fix CVE-2026-68352, update the Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-68352?
CVE-2026-68352 affects systems running the affected versions of the Linux kernel that include the ath6kl wifi driver.
What type of vulnerability is CVE-2026-68352?
CVE-2026-68352 is an out-of-bounds read vulnerability due to improper validation of firmware-controlled lengths.
How does CVE-2026-68352 impact system security?
CVE-2026-68352 can potentially allow an attacker to read memory outside the intended buffer, possibly leading to information disclosure.