CVE-2026-68352
Detail
Received This CVE record has recently been published to the CVE List and has been included within the NVD dataset.
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len
fields in ath6kl_wmi_connect_event_rx() are not validated against the
buffer length. Their sum (up to 765) can exceed the actual WMI event
data, causing out-of-bounds reads during IE parsing and state corruption
of wmi->is_wmm_enabled.
Add a check that the total IE length fits within the buffer.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
NVD assessment
not yet provided.
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS 2.0 Severity and Vector Strings:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected]
Change History
4 change records found show changes
CVE Modified by kernel.org
8/19/2026 1:20:44 PM
Action
Type
Old Value
New Value
Added
Reference
https://git.kernel.org/stable/c/1eeed9efc9a40e0635e910c37fee86543041b4e1
Added
Reference
https://git.kernel.org/stable/c/7cae33e3e09a080db96e3a8980c2c8d288318320
Added
Reference
https://git.kernel.org/stable/c/a38d7d6376b295245b53bc98b7ca682c027abaf7
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"d70c0a850c21b57a6f46ce363860203389bbeaa6","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"33b5342d2080657054ddf89ef1199b426a37dae8","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"94e1bfcefe8264a207c2fda2febb954e70a34b42","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"6b47b29730de3232b919d8362749f6814c5f2a33","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
Record truncated, showing 2048 of 2485 characters.
View Entire Change Record [{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"7cae33e3e09a080db96e3a8980c2c8d288318320","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"1eeed9efc9a40e0635e910c37fee86543041b4e1","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"a38d7d6376b295245b53bc98b7ca682c027abaf7","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"d70c0a850c21b57a6f46ce363860203389bbeaa6","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"33b5342d2080657054ddf89ef1199b426a37dae8","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"94e1bfcefe8264a207c2fda2febb954e70a34b42","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"6b47b29730de3232b919d8362749f6814c5f2a33","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"
CVE Modified by kernel.org
8/17/2026 2:17:43 AM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"d70c0a850c21b57a6f46ce363860203389bbeaa6","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"33b5342d2080657054ddf89ef1199b426a37dae8","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"94e1bfcefe8264a207c2fda2febb954e70a34b42","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"6b47b29730de3232b919d8362749f6814c5f2a33","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"d70c0a850c21b57a6f46ce363860203389bbeaa6","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"33b5342d2080657054ddf89ef1199b426a37dae8","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"94e1bfcefe8264a207c2fda2febb954e70a34b42","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"6b47b29730de3232b919d8362749f6814c5f2a33","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
CVE Modified by kernel.org
8/13/2026 7:17:31 PM
Action
Type
Old Value
New Value
Added
CVSS V3.1
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
New CVE Received from kernel.org
8/10/2026 9:20:27 AM
Action
Type
Old Value
New Value
Added
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len
fields in ath6kl_wmi_connect_event_rx() are not validated against the
buffer length. Their sum (up to 765) can exceed the actual WMI event
data, causing out-of-bounds reads during IE parsing and state corruption
of wmi->is_wmm_enabled.
Add a check that the total IE length fits within the buffer.
Added
Reference
https://git.kernel.org/stable/c/1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e
Added
Reference
https://git.kernel.org/stable/c/33b5342d2080657054ddf89ef1199b426a37dae8
Added
Reference
https://git.kernel.org/stable/c/6b47b29730de3232b919d8362749f6814c5f2a33
Added
Reference
https://git.kernel.org/stable/c/94e1bfcefe8264a207c2fda2febb954e70a34b42
Added
Reference
https://git.kernel.org/stable/c/d70c0a850c21b57a6f46ce363860203389bbeaa6
Added
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"d70c0a850c21b57a6f46ce363860203389bbeaa6","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"33b5342d2080657054ddf89ef1199b426a37dae8","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"94e1bfcefe8264a207c2fda2febb954e70a34b42","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"6b47b29730de3232b919d8362749f6814c5f2a33","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
Quick Info
CVE Dictionary Entry: CVE-2026-68352 NVD
Published Date: 08/10/2026 NVD
Last Modified: 08/19/2026
Source: kernel.org
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
