CVE-2026-68353
Detail
Received This CVE record has recently been published to the CVE List and has been included within the NVD dataset.
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
The firmware-controlled num_msg field (u8, 0-255) drives the loop in
ath6kl_wmi_tx_complete_event_rx() without validation against the buffer
length. This allows out-of-bounds reads of up to 1020 bytes past the
WMI event buffer when the firmware sends an inflated num_msg.
Add a check that the buffer is large enough to hold the fixed struct
and the num_msg variable-length entries.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
NVD assessment
not yet provided.
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0 Severity and Vector Strings:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected]
Change History
4 change records found show changes
CVE Modified by kernel.org
8/19/2026 1:20:44 PM
Action
Type
Old Value
New Value
Added
Reference
https://git.kernel.org/stable/c/0e0fc04af9b443c6b425f00fb604ff599bc80d1d
Added
Reference
https://git.kernel.org/stable/c/35196a07603f8c94a4943093bc26d5b5826285f8
Added
Reference
https://git.kernel.org/stable/c/5297299c3fa6133275db0be99d69cd759b6cbfe9
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"69ac7ba3a3df6654e7daa82674575a8c4a1a63ea","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"289edc3c71344b89e6522891147cfb8f61b088bb","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"eb636fbc443149b3501c3f97e26225ddcb314a0f","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"c38b0d5c661951b5dd082bdf31f8a57a0ce6e540","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
Record truncated, showing 2048 of 2485 characters.
View Entire Change Record [{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"5297299c3fa6133275db0be99d69cd759b6cbfe9","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"35196a07603f8c94a4943093bc26d5b5826285f8","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"0e0fc04af9b443c6b425f00fb604ff599bc80d1d","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"69ac7ba3a3df6654e7daa82674575a8c4a1a63ea","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"289edc3c71344b89e6522891147cfb8f61b088bb","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"eb636fbc443149b3501c3f97e26225ddcb314a0f","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"c38b0d5c661951b5dd082bdf31f8a57a0ce6e540","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"
CVE Modified by kernel.org
8/17/2026 2:17:43 AM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"69ac7ba3a3df6654e7daa82674575a8c4a1a63ea","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"289edc3c71344b89e6522891147cfb8f61b088bb","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"eb636fbc443149b3501c3f97e26225ddcb314a0f","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"c38b0d5c661951b5dd082bdf31f8a57a0ce6e540","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"69ac7ba3a3df6654e7daa82674575a8c4a1a63ea","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"289edc3c71344b89e6522891147cfb8f61b088bb","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"eb636fbc443149b3501c3f97e26225ddcb314a0f","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"c38b0d5c661951b5dd082bdf31f8a57a0ce6e540","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
CVE Modified by kernel.org
8/13/2026 7:17:31 PM
Action
Type
Old Value
New Value
Added
CVSS V3.1
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
New CVE Received from kernel.org
8/10/2026 9:20:27 AM
Action
Type
Old Value
New Value
Added
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
The firmware-controlled num_msg field (u8, 0-255) drives the loop in
ath6kl_wmi_tx_complete_event_rx() without validation against the buffer
length. This allows out-of-bounds reads of up to 1020 bytes past the
WMI event buffer when the firmware sends an inflated num_msg.
Add a check that the buffer is large enough to hold the fixed struct
and the num_msg variable-length entries.
Added
Reference
https://git.kernel.org/stable/c/289edc3c71344b89e6522891147cfb8f61b088bb
Added
Reference
https://git.kernel.org/stable/c/3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495
Added
Reference
https://git.kernel.org/stable/c/69ac7ba3a3df6654e7daa82674575a8c4a1a63ea
Added
Reference
https://git.kernel.org/stable/c/c38b0d5c661951b5dd082bdf31f8a57a0ce6e540
Added
Reference
https://git.kernel.org/stable/c/eb636fbc443149b3501c3f97e26225ddcb314a0f
Added
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"69ac7ba3a3df6654e7daa82674575a8c4a1a63ea","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"289edc3c71344b89e6522891147cfb8f61b088bb","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"eb636fbc443149b3501c3f97e26225ddcb314a0f","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"c38b0d5c661951b5dd082bdf31f8a57a0ce6e540","versionType":"git","status":"affected"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","lessThan":"3a21c89215cc18f1a97c5e5bfd1da6d4f3d44495","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath6kl/wmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
Quick Info
CVE Dictionary Entry: CVE-2026-68353 NVD
Published Date: 08/10/2026 NVD
Last Modified: 08/19/2026
Source: kernel.org
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
