CVE-2026-68353: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler
The firmware-controlled nummsg field (u8, 0-255) drives the loop in ath6klwmitxcompleteeventrx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated nummsg.
Add a check that the buffer is large enough to hold the fixed struct and the nummsg variable-length entries.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68353?
CVE-2026-68353 has a risk rating of 33, indicating a moderate severity level.
How do I fix CVE-2026-68353?
To fix CVE-2026-68353, update to the latest version of the Linux kernel that has patched the vulnerability.
What systems are affected by CVE-2026-68353?
CVE-2026-68353 affects the Linux kernel, particularly the Wi-Fi driver for ath6kl.
What type of vulnerability is CVE-2026-68353?
CVE-2026-68353 is an out-of-bounds read vulnerability related to firmware handling in the Linux kernel.
What could happen if CVE-2026-68353 is exploited?
Exploitation of CVE-2026-68353 could potentially lead to unauthorized access or manipulation of memory, which may compromise system stability or security.