CVE-2026-68352 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled.
Add a check that the total IE length fits within the buffer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides in the ath6kl wireless driver component of the Linux kernel, specifically within the WMI (Wireless Module Interface) event handling mechanism for wireless connectivity operations. This issue represents a classic out-of-bounds read vulnerability that occurs when processing wireless beacon and association information elements during network connection events. The flaw affects the ath6kl driver which is responsible for managing Qualcomm's Atheros 6000 series wireless chipsets, making it particularly relevant to embedded devices and IoT systems that utilize this hardware platform.
The technical implementation flaw occurs in the ath6kl_wmi_connect_event_rx() function where three firmware-controlled fields are processed without proper validation against available buffer boundaries. These fields include beacon_ie_len, assoc_req_len, and assoc_resp_len which represent the lengths of information elements contained within wireless management frames. The vulnerability stems from the absence of bounds checking before summing these length values, allowing a malicious or malformed firmware to specify total lengths that exceed the actual WMI event data buffer size. When the sum of these three fields reaches up to 765 bytes, it can easily surpass the available buffer space, leading to memory access violations.
The operational impact of this vulnerability extends beyond simple memory corruption, as it creates potential pathways for privilege escalation and system instability. During wireless connection establishment, the driver parses various information elements from beacon frames and association responses to configure network parameters and enable WMM (Wireless Multimedia Service) functionality. When out-of-bounds reads occur during this parsing process, the driver's internal state variables become corrupted, particularly affecting the wmi->is_wmm_enabled flag which controls wireless multimedia services. This corruption can lead to unpredictable behavior including system crashes, denial of service conditions, or potentially more severe exploitation scenarios that could allow unauthorized access to kernel memory spaces.
From a cybersecurity perspective, this vulnerability maps directly to CWE-129 and CWE-787 within the Common Weakness Enumeration framework, representing improper input validation and out-of-bounds read conditions respectively. The ATT&CK framework categorizes this issue under T1059.001 for command and scripting interpreter execution through kernel-level memory corruption, and potentially T1484.001 for privilege escalation via kernel exploitation techniques. The vulnerability demonstrates how firmware-controlled parameters can serve as attack vectors when proper input sanitization is omitted from critical kernel subsystems.
The recommended mitigation strategy involves implementing strict bounds checking before processing the summed length values against the actual available buffer size. This validation should occur immediately upon receiving the WMI event data, ensuring that the total of beacon_ie_len + assoc_req_len + assoc_resp_len does not exceed the remaining buffer space. Additionally, implementing proper input sanitization techniques including range validation and buffer overflow protection mechanisms will prevent similar vulnerabilities in related wireless subsystems. System administrators should ensure timely kernel updates and consider implementing network segmentation to limit potential exploitation vectors while awaiting patches for affected devices running vulnerable versions of the Linux kernel with ath6kl driver components.