CVE-2026-92498

What it actually does

Missing length validation before accessing WMI event buffers in ath6kl_wmi_scan_complete_rx, ath6kl_wmi_addba_req_event_rx, and ath6kl_wmi_delba_req_event_rx allows reading past the end of the supplied message into adjacent kernel memory.

Why it matters to the business

Systems using the ath6kl WiFi driver face elevated risk of kernel crashes or unintended disclosure of kernel memory contents, which can reduce device availability and expose sensitive information on affected Linux-based wireless hardware.

How an attack unfolds

An attacker supplies a crafted, undersized WMI event to one of the three handlers; because no size check occurs, the handler reads beyond the actual message length, potentially leaking kernel memory or causing an out-of-bounds read fault.

How to fix it

Update the Linux kernel to a version that adds explicit length checks before dereferencing the event buffers in ath6kl_wmi_scan_complete_rx, ath6kl_wmi_addba_req_event_rx, and ath6kl_wmi_delba_req_event_rx.

How to confirm the fix worked

Inspect the ath6kl WMI handler source for the added size-verification logic or confirm the running kernel is newer than the September 2026 commit that introduced the checks.

Typical attack path

1. Obtain local or wireless access to a system using the vulnerable ath6kl driver
2. Craft a WMI event packet shorter than the structure expected by the handler
3. Deliver the event via the normal WMI event path
4. Trigger the unchecked read in scan-complete, addba-req, or delba-req handler
5. Observe kernel memory disclosure or crash

How to detect it

Review kernel logs for ath6kl-related oops or panic entries around the three named handler functions; correlate with unexpected short WMI events if driver debug logging is enabled.

What your security team should do

• Prioritize kernel updates on any systems exposing the ath6kl driver
• Restrict local user access and wireless attack surface until patched
• Include the ath6kl module in routine kernel vulnerability scanning