Cloudanix VulnDB

CVE-2026-68355

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how certain wireless network cards handle incoming data could let an attacker near the device crash the computer running the system.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Buffer underflow in ath11k_hal_rx_msdu_list_get() caused by unconditional access to msdu_details[i-1] when i==0 and the first MSDU entry has a zero buffer address.

Why it matters to the business

Wireless networking hardware on affected Linux systems may experience kernel crashes or instability, disrupting connectivity and requiring restarts until patched.

How an attack unfolds

An attacker with the ability to influence received MSDU descriptor lists (typically via malicious wireless frames targeting ath11k hardware) supplies a zero buffer address in the first list entry, triggering the out-of-bounds read during list processing.

How to fix it

Apply the upstream fix that adds an explicit i==0 guard before the main loop condition, equivalent to the change already present in ath12k_wifi7_hal_rx_msdu_list_get(). Rebuild and deploy updated kernel packages containing the corrected ath11k HAL code.

How to confirm the fix worked

Inspect the ath11k_hal_rx_msdu_list_get() function in the running kernel source or binary for the added early return or continue when i==0; confirm the vulnerable unconditional decrement is no longer reachable.

Typical attack path

  1. Position attacker-controlled wireless device in range of target ath11k interface
  2. Transmit crafted frames that result in an MSDU details list whose first entry has a zero buffer address
  3. Trigger the ath11k_hal_rx_msdu_list_get() path during RX processing
  4. Cause kernel memory read at invalid offset leading to panic or undefined behavior

How to detect it

Review kernel logs for ath11k-related oops, BUG, or page-fault entries occurring during RX processing; correlate with wireless frame reception timestamps and hardware reset events.

What your security team should do

  • Prioritize kernel updates for systems using ath11k Wi-Fi hardware
  • Monitor vendor advisories for backported patches in supported distributions
  • Test wireless functionality after patching to verify stability under RX load
  • Consider disabling ath11k interfaces on high-risk systems until updated if wireless is non-essential

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow. Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected packages

Ecosystem Package Introduced Fixed