{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68352", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.384Z", "datePublished": "2026-08-10T12:03:29.304Z", "dateUpdated": "2026-08-13T22:43:41.377Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-13T22:43:41.377Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix OOB read from firmware IE lengths in connect event\n\nThe firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len\nfields in ath6kl_wmi_connect_event_rx() are not validated against the\nbuffer length. Their sum (up to 765) can exceed the actual WMI event\ndata, causing out-of-bounds reads during IE parsing and state corruption\nof wmi->is_wmm_enabled.\n\nAdd a check that the total IE length fits within the buffer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "baseScore": 8.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The malformed connect event is produced from the 802.11 association exchange with the peer AP, so a rogue/evil-twin AP or frame-injecting attacker within radio range of the ath6kl station supplies the oversized IE lengths; no local access is needed but the attacker must share the wireless link layer.\nAC:L - The attacker controls the beacon/assoc-request/assoc-response IE content and declared lengths and can force repeated (re)association or roaming with deauth frames until the connect event is emitted, so triggering is reliable and repeatable with no conditions outside the attacker's control.\nPR:N - No credentials or local account are required; the connect event is processed as part of establishing the link with an attacker-controlled AP, before any user-level authorization on the victim system is involved.\nUI:N - No victim action is needed \u2014 a station with a saved profile auto-associates, and the SME_CONNECTED roam path (cfg80211_roamed) processes the same event while the station is already connected, entirely attacker-driven.\nS:U - The out-of-bounds read, the corrupted wmi->is_wmm_enabled state and any resulting crash are all confined to the kernel of the affected host; no VM, IOMMU or sandbox boundary is crossed.\nC:H - Up to 765 bytes of adjacent kernel heap past the WMI event buffer are read and then exported to userspace: copied into the cfg80211 BSS IE cache (readable via unprivileged nl80211 GET_SCAN) and delivered as req_ie/resp_ie in cfg80211_connect_result()/cfg80211_roamed(), a repeatable kernel memory disclosure rather than a few stray bytes.\nI:L - There is no out-of-bounds write, but out-of-bounds bytes drive driver state: wmi->is_wmm_enabled is set from memory beyond the buffer and bogus IE data is inserted into the cfg80211 BSS cache, giving limited attacker-influenced modification of kernel-held data.\nA:H - The IE walk dereferences up to 765 bytes past the received skb and can run off the end of the allocation into unmapped memory (or trip KASAN/DEBUG_PAGEALLOC), producing a kernel oops/panic that the adjacent attacker can retrigger at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath6kl/wmi.c"], "versions": [{"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "d70c0a850c21b57a6f46ce363860203389bbeaa6", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "33b5342d2080657054ddf89ef1199b426a37dae8", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "94e1bfcefe8264a207c2fda2febb954e70a34b42", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "6b47b29730de3232b919d8362749f6814c5f2a33", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath6kl/wmi.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.2-rc5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e"}, {"url": "https://git.kernel.org/stable/c/d70c0a850c21b57a6f46ce363860203389bbeaa6"}, {"url": "https://git.kernel.org/stable/c/33b5342d2080657054ddf89ef1199b426a37dae8"}, {"url": "https://git.kernel.org/stable/c/94e1bfcefe8264a207c2fda2febb954e70a34b42"}, {"url": "https://git.kernel.org/stable/c/6b47b29730de3232b919d8362749f6814c5f2a33"}], "title": "wifi: ath6kl: fix OOB read from firmware IE lengths in connect event", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath6kl/wmi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "d70c0a850c21b57a6f46ce363860203389bbeaa6", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "33b5342d2080657054ddf89ef1199b426a37dae8", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "94e1bfcefe8264a207c2fda2febb954e70a34b42", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "6b47b29730de3232b919d8362749f6814c5f2a33", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath6kl/wmi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc5", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix OOB read from firmware IE lengths in connect event\n\nThe firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len\nfields in ath6kl_wmi_connect_event_rx() are not validated against the\nbuffer length. Their sum (up to 765) can exceed the actual WMI event\ndata, causing out-of-bounds reads during IE parsing and state corruption\nof wmi->is_wmm_enabled.\n\nAdd a check that the total IE length fits within the buffer."}], "id": "CVE-2026-68352", "lastModified": "2026-08-13T23:17:31.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:27.353", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/33b5342d2080657054ddf89ef1199b426a37dae8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b47b29730de3232b919d8362749f6814c5f2a33"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94e1bfcefe8264a207c2fda2febb954e70a34b42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d70c0a850c21b57a6f46ce363860203389bbeaa6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: ath6kl Wi-Fi driver out-of-bounds read due to unvalidated firmware data", "id": "2513376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513376"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: ath6kl: fix OOB read from firmware IE lengths in connect event\nThe firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len\nfields in ath6kl_wmi_connect_event_rx() are not validated against the\nbuffer length. Their sum (up to 765) can exceed the actual WMI event\ndata, causing out-of-bounds reads during IE parsing and state corruption\nof wmi->is_wmm_enabled.\nAdd a check that the total IE length fits within the buffer.", "A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. The driver does not properly validate the lengths of firmware-controlled information elements (IEs) during a connect event. This vulnerability allows the sum of these lengths to exceed the allocated buffer, resulting in an out-of-bounds read. An attacker could exploit this to cause state corruption within the driver, potentially leading to a denial of service."], "name": "CVE-2026-68352", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:03:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68352\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68352\nhttps://git.kernel.org/stable/c/1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e\nhttps://git.kernel.org/stable/c/33b5342d2080657054ddf89ef1199b426a37dae8\nhttps://git.kernel.org/stable/c/6b47b29730de3232b919d8362749f6814c5f2a33\nhttps://git.kernel.org/stable/c/94e1bfcefe8264a207c2fda2febb954e70a34b42\nhttps://git.kernel.org/stable/c/d70c0a850c21b57a6f46ce363860203389bbeaa6"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,d70c0a850c21b57a6f46ce363860203389bbeaa6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,33b5342d2080657054ddf89ef1199b426a37dae8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,94e1bfcefe8264a207c2fda2febb954e70a34b42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,6b47b29730de3232b919d8362749f6814c5f2a33)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T16:45:03.477087+00:00", "updated": "2026-08-14T04:00:11.996616+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}