wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled. Add a check that the total IE length fits within the buffer.

Timeline

1. Aug 10, 2026, 12:03 PM UTCCVE published
2. Oct 16, 2026, 3:47 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 19, 2026, 9:09 PM UTCRecord last updated

Affected versions

• Linux Linux

  From bdcd81707973cf8aa9305337166f8ee842a050d4 · fixed in 7cae33e3e09a080db96e3a8980c2c8d288318320; From bdcd81707973cf8aa9305337166f8ee842a050d4 · fixed in 1eeed9efc9a40e0635e910c37fee86543041b4e1; From bdcd81707973cf8aa9305337166f8ee842a050d4 · fixed in a38d7d6376b295245b53bc98b7ca682c027abaf7; From bdcd81707973cf8aa9305337166f8ee842a050d4 · fixed in 1c690f7c4c5b37108ac8c98b94ce1b3c655a4f5e; From bdcd81707973cf8aa9305337166f8ee842a050d4 · fixed in d70c0a850c21b57a6f46ce363860203389bbeaa6; From bdcd81707973cf8aa9305337166f8ee842a050d4 · fixed in 33b5342d2080657054ddf89ef1199b426a37dae8; From bdcd81707973cf8aa9305337166f8ee842a050d4 · fixed in 94e1bfcefe8264a207c2fda2febb954e70a34b42; From bdcd81707973cf8aa9305337166f8ee842a050d4 · fixed in 6b47b29730de3232b919d8362749f6814c5f2a33

• Linux Linux

  3.2

• KernelLinux

  From 3.2.0 · fixed in 5.10.265; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.148; From 6.7.0 · fixed in 6.12.101; From 6.13.0 · fixed in 6.18.42; From 6.19.0 · fixed in 7.1.6

References 8