CVE-2026-68352

HighCVSS 8.3/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled.

Add a check that the total IE length fits within the buffer.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= bdcd81707973cf8aa9305337166f8ee842a050d4, < 7cae33e3e09a080db96e3a8980c2c8d288318320; >= bdcd81707973cf8aa9305337166f8ee842a050d4, < 1eeed9efc9a40e0635e910c37fee86543041b4e1; >= bdcd81707973cf8aa9305337166f8ee842a050d4, < a38d7d6376b295245b53bc98b7ca682c027abaf7; >= bdcd81707973cf8aa9305337166f8ee842a050d4, < 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e; >= bdcd81707973cf8aa9305337166f8ee842a050d4, < d70c0a850c21b57a6f46ce363860203389bbeaa6; >= bdcd81707973cf8aa9305337166f8ee842a050d4, < 33b5342d2080657054ddf89ef1199b426a37dae8; >= bdcd81707973cf8aa9305337166f8ee842a050d4, < 94e1bfcefe8264a207c2fda2febb954e70a34b42; >= bdcd81707973cf8aa9305337166f8ee842a050d4, < 6b47b29730de3232b919d8362749f6814c5f2a33
LinuxLinux3.2

References

Timeline

Published
Aug 10, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-683538.1In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handlerCVE-2026-683548.8In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeCVE-2026-68355In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_listCVE-2026-68356In the Linux kernel, the following vulnerability has been resolved: watchdog: airoha: Prevent division by zero when clock frequency is zeroCVE-2026-68357In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() When aCVE-2026-68358In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop CallinCVE-2026-68359In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop CallingCVE-2026-68360In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop CallinCVE-2026-68361In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hid_hw_CVE-2026-68362In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_beCVE-2026-68363In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmwarCVE-2026-68364In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix ISM dc_lock deadlock during suspend [Why] System
CVE-2026-68352: High severity, CVSS 8.3 | Vulnix