CVE-2026-89524Medium· 5.5▾ SunlitA flaw was found in the ath6kl Wi-Fi driver of the Linux kernel. An integer underflow vulnerability occurs when processing Wi-Fi association requests or responses that are shorter than expected. This can cause the system to read beyond the…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
— → 6.4
none → medium
— → 6.4
none → medium
— → 8.1
none → high
8.1 → 6.4
high → medium
6.4 → 8.1
medium → high
0.2% → 0.3%
Last analysed / modified upstream
8.1 → 5.5
high → medium
A flaw was found in the ath6kl Wi-Fi driver of the Linux kernel. An integer underflow vulnerability occurs when processing Wi-Fi association requests or responses that are shorter than expected. This can cause the system to read beyond the intended buffer, leading to the disclosure of adjacent memory to a remote attacker. This information disclosure could potentially expose sensitive data.
kernel: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-16.
Not affected:
Refer to the advisory for fix availability.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90407High· 7.7In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infras…
CVE-2026-89763High· 7.8In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type
CVE-2026-89723Medium· 5.5kernel: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (CVE-2026-89723)
CVE-2026-96546Low· 2.5A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader
CVE-2026-96545Medium· 4.4An out-of-bounds heap read flaw was found in GIMP's TIM image loader
CVE-2026-88840Medium· 5.3BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.