CVE-2026-92498: wifi: ath6kl: avoid buffer overreads in WMI event handlers
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: avoid buffer overreads in WMI event handlers
The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event: ath6klwmiscancompleterx() ath6klwmiaddbareqeventrx() ath6klwmidelbareqeventrx()
Add length checks to prevent overread.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the resolved fix for the Linux kernel vulnerability "wifi: ath6kl: avoid buffer overreads in WMI event handlers" by adding length checks before reading from the WMI event buffer in the following handlers: ath6kl_wmi_addba_req_event_rx(), ath6kl_wmi_delba_req_event_rx(), and ath6kl_wmi_scan_complete_rx().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the ath6kl Wi-Fi driver are exposed when they process the affected WMI scan-complete, ADDBA-request, or DELBA-request events.
What must an attacker be able to do to trigger the overread?
The issue is triggered by an event buffer that is shorter than the structure expected by one of the affected WMI event handlers. The provided data does not specify how an attacker could cause such a malformed event to be delivered.
How can I determine whether a fix is available in my kernel source?
Check whether the ath6kl WMI event handlers ath6kl_wmi_scan_complete_rx(), ath6kl_wmi_addba_req_event_rx(), and ath6kl_wmi_delba_req_event_rx() validate the received event-buffer length before reading the expected event structure. The listed stable kernel references contain the associated fixes.