HIGH Introduced in 3.2
ath6kl TxComplete OOB
CVE-2026-68353
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
KernelScan AI8.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg. Add a check that the buffer is large enough to hold the fixed struct and the num_msg variable-length entries.
02KernelScan AI Analysis
Risk summary
The ath6kl WiFi driver trusts a firmware-supplied count field when processing TX completion events, allowing an out-of-bounds read of up to 1020 bytes past the event buffer. An attacker within WiFi range of a device using an affected ath6kl wireless chipset could trigger this by influencing the firmware to emit a malformed completion event. The impact is limited to potential kernel memory disclosure and possible denial of service if the over-read accesses unmapped memory.
Vulnerability analysis
The ath6kl wireless driver processes events from the WiFi chipset firmware that report completed packet transmissions. The number of completions reported by the firmware is used to iterate over a data buffer, but the driver never verifies that the buffer is actually large enough to hold that many entries. When the firmware sends an inflated completion count, the driver reads past the end of the buffer, exposing up to 1020 bytes of adjacent kernel memory. The fix adds a length check before the loop so that any event whose reported count exceeds the buffer capacity is rejected. This code path is reachable from any device within WiFi range that can trigger transmission activity on the affected ath6kl interface, requiring no authentication or prior privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.2 | 5.10.265 | 5297299c3fa6 |
| 5.15 | 3.2 | 5.15.216 | 35196a07603f |
| 6.1 | 3.2 | 6.1.183 | 0e0fc04af9b4 |
| 6.12 | 3.2 | 6.12.101 | 289edc3c7134 |
| 6.18 | 3.2 | 6.18.42 | eb636fbc4431 |
| 6.6 | 3.2 | 6.6.148 | 69ac7ba3a3df |
| 7.1 | 3.2 | 7.1.6 | c38b0d5c6619 |
| mainline | 3.2 | 7.2 | 3a21c89215cc |
| cip/4.19 | 3.2 | 4.19.325-cip136 | f62671761a37 |
| cip/4.19-rt | 3.2 | 4.19.325-cip136-rt50 | f62671761a37 |
| cip/4.4 | 3.2 | 4.4.302-cip115 | 4f2c82513141 |
| cip/4.4-rt | 3.2 | 4.4.302-cip115-rt63 | 4f2c82513141 |
| cip/5.10 | 3.2 | 5.10.268-cip77 | 5297299c3fa6 |
| cip/5.10-rt | 3.2 | 5.10.268-cip77-rt34 | 5297299c3fa6 |
| cip/6.1 | 3.2 | 6.1.187-cip60 | 0e0fc04af9b4 |
| cip/6.1-rt | 3.2 | 6.1.189-cip61-rt32 | 0e0fc04af9b4 |
| cip/6.12 | 3.2 | 6.12.101-cip29 | 289edc3c7134 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |
| cip/4.4 | Fixed in 4.4.302-cip115 |
| cip/4.4-rt | Fixed in 4.4.302-cip115-rt63 |