CVE-2026-68353 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg.
Add a check that the buffer is large enough to hold the fixed struct and the num_msg variable-length entries.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides in the ath6kl wireless driver within the Linux kernel, specifically affecting the WMI (Wireless Microcontroller Interface) transaction complete event handler. This issue represents a classic out-of-bounds read condition that occurs when processing firmware-generated messages, where the driver fails to validate critical buffer parameters before proceeding with memory access operations. The flaw is particularly concerning as it operates at the kernel level, potentially allowing malicious firmware to execute arbitrary code or cause system instability through carefully crafted packet sequences.
The technical implementation of this vulnerability involves the ath6kl_wmi_tx_complete_event_rx() function which processes transmission complete events from wireless firmware components. The driver reads a u8 field called num_msg from the firmware-controlled buffer and uses this value to determine loop iterations for processing message entries within the WMI event structure. This field, which should contain values between 0 and 255 according to its data type definition, is used directly in loop bounds without any validation against the actual available buffer space. The absence of bounds checking creates a scenario where an attacker-controlled firmware can specify an inflated num_msg value that exceeds the allocated buffer boundaries.
The operational impact of this vulnerability extends beyond simple memory corruption, as it can potentially enable privilege escalation or denial-of-service conditions within the kernel space. When firmware sends an oversized num_msg value, the driver continues processing beyond valid buffer limits, reading up to 1020 bytes past the intended WMI event buffer boundary. This behavior creates opportunities for information disclosure through memory leaks, potential code execution via controlled data corruption, or system crashes that could lead to complete service disruption. The vulnerability affects systems using ath6kl wireless drivers and demonstrates the critical importance of input validation in kernel-level network processing components.
The fix implemented addresses this vulnerability by adding proper buffer size validation before any processing occurs within the WMI event handler. This remediation follows established security practices for preventing out-of-bounds memory access conditions and aligns with CWE-129, which specifically addresses insufficient bounds checking in array indexing operations. The solution requires verifying that the buffer contains sufficient space not only for the fixed-size WMI structure but also for the variable-length entries specified by num_msg. This approach directly corresponds to ATT&CK technique T1059.008, which involves command and scripting interpreter usage, as proper bounds checking prevents malicious input from being processed beyond intended boundaries. The mitigation strategy ensures that all firmware-controlled parameters undergo validation before use in loop conditions or memory access operations, thereby preventing the exploitation vector while maintaining functional compatibility with legitimate firmware behavior.
This vulnerability highlights the critical need for robust input validation in kernel network drivers where firmware components can influence memory access patterns through parameter values. The fix demonstrates proper defensive programming practices that should be applied across all kernel subsystems handling firmware communication to prevent similar issues from arising in other wireless or network driver implementations.