CVE-2026-68352
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the connect event handler. The firmware-controlled fields beacon_ie_len, assoc_req_len, and assoc_resp_len are not validated against buffer length, potentially causing OOB reads during IE parsing and corruption of wmi->is_wmm_enabled state.
Risk Assessment
Possible kernel memory disclosure, system crash, or incorrect WMM functionality.
Recommendation
Install the Linux kernel patch that validates total IE length against the buffer.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled. Add a check that the total IE length fits within the buffer.