CVE-2026-68353
High · 8.1CVSS
8.1
EPSS
0.3%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A wireless driver bug lets specially crafted network events read memory they should not, which can leak information or crash the system on affected Linux devices.
- Exploitation
- Adjacent Network
- Attacker needs
- None
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds read in ath6kl_wmi_tx_complete_event_rx() where an unvalidated u8 num_msg value (0-255) from firmware drives a loop that can access up to 1020 bytes past the WMI event buffer without length checks against the received buffer.
Why it matters to the business
Wireless network instability, potential kernel memory disclosure, or crashes on Linux systems using ath6kl drivers, increasing operational risk for devices relying on affected wireless hardware.
How an attack unfolds
An attacker on the adjacent network supplies a crafted or inflated num_msg value via a WMI TX complete event from compromised or malicious firmware, bypassing the missing buffer-size validation and triggering repeated out-of-bounds reads.
How to fix it
Apply the upstream kernel patch that adds an explicit buffer-length check ensuring sufficient space for the fixed struct plus num_msg entries before entering the processing loop; rebuild and deploy updated kernels on affected systems.
How to confirm the fix worked
Inspect the ath6kl_wmi_tx_complete_event_rx function in the kernel source for the added length validation; test by replaying maximum-length and oversized num_msg events in a controlled environment and confirm no out-of-bounds access occurs.
Typical attack path
- Position on adjacent network to influence ath6kl firmware events
- Trigger transmission complete path with inflated num_msg value
- Cause loop to read beyond allocated WMI event buffer
- Observe or exfiltrate kernel memory contents or induce denial of service
How to detect it
Review kernel logs and dmesg output for repeated ath6kl_wmi_tx_complete_event_rx entries, unexpected oops, or memory access violations; correlate with wireless event timestamps and firmware interaction traces.
- ath6kl_wmi_tx_complete_event_rx
- num_msg
What your security team should do
- Prioritize kernel updates containing the buffer validation fix for all systems using ath6kl wireless drivers
- Monitor kernel logs for ath6kl-related oops or warnings indicating anomalous TX complete events
- Limit exposure by restricting adjacent network access to wireless interfaces where feasible until patched
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg. Add a check that the buffer is large enough to hold the fixed struct and the num_msg variable-length entries.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|