CVE-2026-68355 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a
buffer underflow.
Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in the linux kernel represents a critical buffer underflow condition within the ath11k wireless driver implementation that could potentially lead to system instability or arbitrary code execution. This flaw exists specifically within the ath11k_hal_rx_msdu_list_get() function which handles received wireless frame processing. The issue manifests when the first entry in the msdu_details array contains a zero buffer address, creating a scenario where the code attempts to access memory at an invalid offset that precedes the allocated buffer boundaries.
The technical root cause stems from improper boundary validation within the wireless driver's receive processing logic. When the loop processes msdu_details entries and encounters i == 0 with a zero buffer address in the first element, the subsequent code execution attempts to reference msdu_details[i - 1] which translates to msdu_details[-1]. This invalid memory access pattern constitutes a classic buffer underflow vulnerability that falls under CWE-129, specifically addressing issues related to improper validation of the lower bounds of an array access. The flaw demonstrates poor defensive programming practices where the code does not adequately validate loop indices before performing array dereferences.
The operational impact of this vulnerability extends beyond simple system crashes as it could potentially enable privilege escalation or denial of service conditions within wireless networking operations. Wireless access points and client devices utilizing the ath11k driver would be susceptible to exploitation, particularly in environments where malicious actors might attempt to inject malformed wireless frames designed to trigger this specific buffer underflow condition. The vulnerability affects systems running linux kernel versions that include the affected ath11k driver component, creating a potential attack surface for adversaries seeking to disrupt wireless communications or gain unauthorized system access through wireless networking interfaces.
The fix implemented addresses this vulnerability by introducing a separate boundary check for i == 0 before evaluating the main condition that could lead to out-of-bounds access. This remediation approach follows established security best practices and aligns with the defensive programming principles recommended in the ATT&CK framework under T1068, which addresses privilege escalation techniques through software vulnerabilities. The solution mirrors the approach used in the ath12k_wifi7_hal_rx_msdu_list_get() function, demonstrating consistency in addressing similar buffer management issues across different driver implementations within the same wireless subsystem. This defensive programming technique prevents the invalid memory access by ensuring that array indices remain within valid bounds before any dereference operations occur, thereby eliminating the potential for exploitation through controlled input data manipulation.
The discovery of this vulnerability through the Linux Verification Center's SVACE tool highlights the importance of systematic code analysis and formal verification techniques in identifying subtle memory safety issues. This finding underscores the necessity of comprehensive testing methodologies including static analysis, dynamic analysis, and formal verification approaches to detect buffer underflow conditions that may not be apparent during conventional code review processes. Security researchers should continue employing such systematic verification tools when analyzing kernel subsystems where memory corruption vulnerabilities could provide attackers with significant exploitation opportunities.