{"id":"CVE-2026-68352","title":"wifi: ath6kl: fix OOB read from firmware IE lengths in connect event","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix OOB read from firmware IE lengths in connect event\n\nThe firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len\nfields in ath6kl_wmi_conn…","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 7cae33e3e09a080db96e3a8980c2c8d288318320","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 1eeed9efc9a40e0635e910c37fee86543041b4e1","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < a38d7d6376b295245b53bc98b7ca682c027abaf7","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < d70c0a850c21b57a6f46ce363860203389bbeaa6","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 33b5342d2080657054ddf89ef1199b426a37dae8","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 94e1bfcefe8264a207c2fda2febb954e70a34b42","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 6b47b29730de3232b919d8362749f6814c5f2a33","Linux 3.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:47:23.757478Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:09.183Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68352","references":[{"url":"https://git.kernel.org/stable/c/7cae33e3e09a080db96e3a8980c2c8d288318320"},{"url":"https://git.kernel.org/stable/c/1eeed9efc9a40e0635e910c37fee86543041b4e1"},{"url":"https://git.kernel.org/stable/c/a38d7d6376b295245b53bc98b7ca682c027abaf7"},{"url":"https://git.kernel.org/stable/c/1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e"},{"url":"https://git.kernel.org/stable/c/d70c0a850c21b57a6f46ce363860203389bbeaa6"},{"url":"https://git.kernel.org/stable/c/33b5342d2080657054ddf89ef1199b426a37dae8"},{"url":"https://git.kernel.org/stable/c/94e1bfcefe8264a207c2fda2febb954e70a34b42"},{"url":"https://git.kernel.org/stable/c/6b47b29730de3232b919d8362749f6814c5f2a33"}],"tags":["cve.org"],"epss":0.00413,"epssPercentile":0.34135,"ingestedAt":"2026-10-16T17:24:46.860Z","slug":"CVE-2026-68352","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix OOB read from firmware IE lengths in connect event\n\nThe firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len\nfields in ath6kl_wmi_connect_event_rx() are not validated against the\nbuffer length. Their sum (up to 765) can exceed the actual WMI event\ndata, causing out-of-bounds reads during IE parsing and state corruption\nof wmi->is_wmm_enabled.\n\nAdd a check that the total IE length fits within the buffer.\n\n## Affected\n\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 7cae33e3e09a080db96e3a8980c2c8d288318320`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 1eeed9efc9a40e0635e910c37fee86543041b4e1`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < a38d7d6376b295245b53bc98b7ca682c027abaf7`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < d70c0a850c21b57a6f46ce363860203389bbeaa6`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 33b5342d2080657054ddf89ef1199b426a37dae8`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 94e1bfcefe8264a207c2fda2febb954e70a34b42`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 6b47b29730de3232b919d8362749f6814c5f2a33`\n- `Linux 3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":45.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}