Cloudanix VulnDB

CVE-2026-68196

High · 8.3

CVSS

8.3

EPSS

0.4%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how certain Linux WiFi chips handle connection reply packets from networks could let nearby attackers read memory or crash the device.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing length validation on received association response frames allows integer underflow when computing trailing IE length, resulting in out-of-bounds reads (CWE-125) of the fixed header and potential oversized kmemdup copies beyond the actual buffer.

Why it matters to the business

Wireless Linux systems using the wilc1000 driver face risk of remote memory disclosure or crashes during WiFi association, potentially leading to device instability or information exposure on affected hardware.

How an attack unfolds

An attacker within wireless range crafts and transmits an association response frame shorter than 6 bytes; the driver passes the short buffer directly to wilc_parse_assoc_resp_info, which subtracts the header size without a bounds check, causing wrap-around, invalid status_code access, and oversized memory operations.

How to fix it

Apply the upstream kernel fix that rejects frames shorter than sizeof(struct wilc_assoc_resp) before header access or ies_len calculation and sets connection status to failure on that path.

How to confirm the fix worked

Confirm presence of the length check (buffer_len >= sizeof(struct wilc_assoc_resp)) in wilc_parse_assoc_resp_info; test with deliberately short frames to ensure rejection without OOB access.

Typical attack path

  1. Position within WiFi range of target
  2. Transmit malformed association response shorter than fixed header
  3. Trigger host_int_parse_assoc_resp_info and wilc_parse_assoc_resp_info
  4. Induce underflow and out-of-bounds memory access

How to detect it

Inspect kernel logs and crash dumps for wilc1000 driver entries around association response parsing; look for unexpected kmemdup calls or oops related to short buffers in host_int_parse_assoc_resp_info.

What your security team should do

  • Patch wilc1000 driver in all Linux kernels as soon as fixed versions are available
  • Disable wilc1000 interfaces where not required
  • Monitor kernel logs for wilc association parsing anomalies
  • Apply wireless client isolation or firmware updates from hardware vendors

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: validate assoc response length before subtracting header wilc_parse_assoc_resp_info() computes the trailing IE length as ies_len = buffer_len - sizeof(*res); without first checking that buffer_len is at least sizeof(struct wilc_assoc_resp) (6 bytes). buffer_len is the length reported for a received association response (host_int_parse_assoc_resp_info() passes hif_drv->assoc_resp / assoc_resp_info_len straight in) and must be validated before the driver accesses the fixed header. For a frame shorter than the 6-byte fixed header, the subtraction wraps. For a four-byte response the result is truncated to a u16 ies_len of 65534, so kmemdup() then attempts to copy 65534 bytes starting at buffer + sizeof(*res), beyond the valid association-response data (CWE-125). A response shorter than four bytes can also cause an out-of-bounds read of res->status_code at offsets 2 and 3. Reject frames too short to hold the fixed header before touching the header or computing ies_len. Also set the connection status to a failure on this path: the caller falls through to a "conn_info->status == WLAN_STATUS_SUCCESS" check after the parser returns, so leaving the status untouched could let a malformed short response be treated as a successful association.

Affected packages

Ecosystem Package Introduced Fixed