CVE-2026-68353
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
In the Linux kernel, the ath6kl driver has an out-of-bounds read vulnerability in the TX complete event handler. The firmware-controlled num_msg field (u8, 0-255) drives the loop without validation against buffer length, allowing reads up to 1020 bytes past the WMI event buffer.
Risk Assessment
An attacker with firmware access could cause kernel memory disclosure or a system crash (kernel panic).
Recommendation
Apply the Linux kernel update that adds buffer length validation before processing num_msg.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg. Add a check that the buffer is large enough to hold the fixed struct and the num_msg variable-length entries.