CVE-2026-89524: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
ath6klcfg80211connectevent() subtracts fixed IE offsets from assocreqlen (-= 4) and assocresplen (-= 6), both u8, with no lower bound. The aggregate check recently added to ath6klwmiconnecteventrx() bounds the declared lengths from above (their sum must fit the received event), but an assoc request/response shorter than its fixed offset still underflows here: the u8 wraps to ~250, and cfg80211connectresult() / cfg80211roamed() then treat that wrapped value as the IE length and copy that many bytes out of the small associnfo buffer to user space via nl80211, disclosing adjacent slab memory.
Clamp both lengths to their offsets before subtracting.
Found by 0sec (https://0sec.ai) using automated source analysis; the missing lower bound is evident from source. Compile-tested.
Affected Software
Event History
Frequently Asked Questions
Which systems are in scope for this issue?
Systems using the Linux kernel ath6kl Wi-Fi driver are in scope, specifically the association connect-event handling path that passes association information to cfg80211 and nl80211.
What condition triggers the memory disclosure?
The received association request length must be below 4 bytes or the association response length below 6 bytes. Subtracting those fixed offsets from unsigned 8-bit length fields causes underflow and wraps the resulting IE length to a large value.
What is exposed if the flaw is triggered?
cfg80211_connect_result() or cfg80211_roamed() can copy beyond the small association-information buffer to user space through nl80211, disclosing adjacent slab memory.
What does the fix change?
The fix clamps association request and response lengths to their respective fixed offsets before subtracting them, preventing unsigned-length underflow.