CVE-2026-89524
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In the Linux kernel's ath6kl wifi driver, ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len and assoc_resp_len (both u8) without a lower bound. When the length is smaller than the offset, the u8 wraps to about 250, and cfg80211_connect_result()/cfg80211_roamed() treat that wrapped value as the IE length and copy that many bytes from the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory.
Risk Assessment
A local attacker can leak kernel memory contents (adjacent slab objects), potentially exposing sensitive data or aiding further exploitation (e.g., KASLR bypass).
Recommendation
Update the Linux kernel to a version containing the fix that clamps both lengths to their offsets before subtracting. If updating is not possible, consider restricting or disabling the ath6kl driver.
Related vulnerabilities
- CVE-2026-103409Critical
A missing authentication for a critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. The vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor; it can no longer be exploited once the device is onboarded.
- CVE-2026-103406Critical
An improper neutralization of special elements used in an OS command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
- CVE-2026-44179Critical
The `excerpt-include` macro in XWiki Remote Macros does not properly escape the included page's title and executes `excerpt` content with the macro's rights. Both the title handling and the rendering of `excerpt` content into XWiki syntax allow syntax injection. Any user able to edit a page, even without script rights, can supply executable macro syntax and cause remote code execution when the page is included.
- CVE-2026-115968Critical
A deserialization of untrusted data vulnerability in the Ultimate Member WordPress plugin allows Object Injection. Affects versions up to and including 2.13.1.
- CVE-2026-105420Critical
Wing FTP Server does not verify the user's base folder, allowing an attacker with admin privileges to add user directories via scripts that escape the base folder. This enables file writes on the system and potential remote code execution with process owner privileges, and with sudo-based installation files are created as root. Fixed in version 8.2.6.
- CVE-2026-67074Critical
HCL BigFix AEX is affected by a Remote Code Execution (RCE) vulnerability. An attacker may execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.
- CVE-2026-115904Critical
Topluyo Desktop for Linux prior to version 2026.9.2410 unsafely processes user-controlled URLs, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
- CVE-2026-115607Critical
The Crowd Favorite DXP ToolKit plugin contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects DXP ToolKit versions from n/a through 2.0.1.
- CVE-2026-111411Critical
The Aman FunnelKit Automations (wp-marketing-automations) plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects FunnelKit Automations versions from n/a through 3.8.5.2.
- CVE-2026-118477Critical
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. An authenticated attacker can execute arbitrary commands with www-data privileges. Fixed in version 2026061802.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx() bounds the declared lengths from above (their sum must fit the received event), but an assoc request/response shorter than its fixed offset still underflows here: the u8 wraps to ~250, and cfg80211_connect_result() / cfg80211_roamed() then treat that wrapped value as the IE length and copy that many bytes out of the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory. Clamp both lengths to their offsets before subtracting. Found by 0sec (https://0sec.ai) using automated source analysis; the missing lower bound is evident from source. Compile-tested.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS