---
id: CVE-2026-68352
title: 'wifi: ath6kl: fix OOB read from firmware IE lengths in connect event'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

  The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len
  fields in ath6kl_wmi_conn…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 <
    7cae33e3e09a080db96e3a8980c2c8d288318320
  - >-
    Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 <
    1eeed9efc9a40e0635e910c37fee86543041b4e1
  - >-
    Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 <
    a38d7d6376b295245b53bc98b7ca682c027abaf7
  - >-
    Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 <
    1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e
  - >-
    Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 <
    d70c0a850c21b57a6f46ce363860203389bbeaa6
  - >-
    Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 <
    33b5342d2080657054ddf89ef1199b426a37dae8
  - >-
    Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 <
    94e1bfcefe8264a207c2fda2febb954e70a34b42
  - >-
    Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 <
    6b47b29730de3232b919d8362749f6814c5f2a33
  - Linux 3.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:47:23.757478Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:09.183Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68352'
references:
  - url: 'https://git.kernel.org/stable/c/7cae33e3e09a080db96e3a8980c2c8d288318320'
  - url: 'https://git.kernel.org/stable/c/1eeed9efc9a40e0635e910c37fee86543041b4e1'
  - url: 'https://git.kernel.org/stable/c/a38d7d6376b295245b53bc98b7ca682c027abaf7'
  - url: 'https://git.kernel.org/stable/c/1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e'
  - url: 'https://git.kernel.org/stable/c/d70c0a850c21b57a6f46ce363860203389bbeaa6'
  - url: 'https://git.kernel.org/stable/c/33b5342d2080657054ddf89ef1199b426a37dae8'
  - url: 'https://git.kernel.org/stable/c/94e1bfcefe8264a207c2fda2febb954e70a34b42'
  - url: 'https://git.kernel.org/stable/c/6b47b29730de3232b919d8362749f6814c5f2a33'
tags:
  - cve.org
epss: 0.00413
epssPercentile: 0.34135
ingestedAt: '2026-10-16T17:24:46.860Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len
fields in ath6kl_wmi_connect_event_rx() are not validated against the
buffer length. Their sum (up to 765) can exceed the actual WMI event
data, causing out-of-bounds reads during IE parsing and state corruption
of wmi->is_wmm_enabled.

Add a check that the total IE length fits within the buffer.

## Affected

- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 7cae33e3e09a080db96e3a8980c2c8d288318320`
- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 1eeed9efc9a40e0635e910c37fee86543041b4e1`
- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < a38d7d6376b295245b53bc98b7ca682c027abaf7`
- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e`
- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < d70c0a850c21b57a6f46ce363860203389bbeaa6`
- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 33b5342d2080657054ddf89ef1199b426a37dae8`
- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 94e1bfcefe8264a207c2fda2febb954e70a34b42`
- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 6b47b29730de3232b919d8362749f6814c5f2a33`
- `Linux 3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.