CVE-2026-68352

What it actually does

Unvalidated firmware-controlled IE length fields (beacon_ie_len, assoc_req_len, assoc_resp_len) in ath6kl_wmi_connect_event_rx allow their sum to exceed the WMI event buffer, causing out-of-bounds reads during IE parsing and corrupting wmi->is_wmm_enabled state.

Why it matters to the business

Wireless devices using affected ath6kl drivers may experience crashes, unexpected behavior, or memory corruption when connecting to Wi-Fi networks, increasing downtime and exposure on enterprise or embedded Linux systems.

How an attack unfolds

An attacker positioned on the same wireless network supplies a crafted connect event via a rogue access point or compromised firmware; the kernel driver processes the oversized IE lengths without bounds checking, triggering the out-of-bounds read and state corruption during event handling.

How to fix it

Apply the upstream kernel patch that adds an explicit check ensuring the total IE length fits within the received WMI event buffer; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the bounds check in ath6kl_wmi_connect_event_rx in the running kernel source or binary; test with a synthetic WMI event containing maximum-length IE fields and verify no out-of-bounds access occurs.

Typical attack path

1. Attacker deploys rogue AP or manipulates firmware to emit WMI connect event
2. Driver receives event with beacon_ie_len + assoc_req_len + assoc_resp_len exceeding buffer size
3. IE parsing loop reads past allocated buffer and overwrites wmi->is_wmm_enabled
4. Resulting memory corruption leads to crash or altered driver behavior

How to detect it

Inspect kernel logs for ath6kl oops, warning messages referencing wmi connect event, or unexpected changes to is_wmm_enabled state; correlate with wireless association events from untrusted BSSIDs.

What your security team should do

• Prioritize kernel updates for all Linux systems using ath6kl Wi-Fi drivers
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict Wi-Fi association to trusted access points until patches are applied
• Enable kernel address-space layout randomization and memory debugging features for detection