HIGH Introduced in 5.6
ath11k RxMsduList Underflow
CVE-2026-68355
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow. Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.
02KernelScan AI Analysis
Risk summary
A device using a Qualcomm ath11k WiFi adapter can be attacked by anyone within WiFi range sending crafted wireless frames. The out-of-bounds read can expose sensitive kernel memory and corrupt internal state, potentially leading to arbitrary code execution or a kernel panic. No privileges on the target device are required.
Vulnerability analysis
When the ath11k WiFi driver processes a list of received packet descriptors, it checks each entry for a zero buffer address and, upon finding one, reads metadata from the previous entry. If the very first entry has a zero address, the code reads from before the start of the descriptor array, accessing out-of-bounds memory. The fix adds an early check that stops processing when the first entry has a zero buffer address, preventing the underflow. This vulnerability is reachable by an attacker within WiFi range of a device equipped with a Qualcomm ath11k WiFi adapter; no privileges or user interaction on the target are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.6 | 5.10.265 | 085a5fde5bac |
| 5.15 | 5.6 | 5.15.216 | 31ea4b175bc3 |
| 6.1 | 5.6 | 6.1.183 | 20d18a5ec6ec |
| 6.12 | 5.6 | 6.12.101 | 904367381a92 |
| 6.18 | 5.6 | 6.18.42 | a154ca3c441a |
| 6.6 | 5.6 | 6.6.148 | 69a6a4f60b2d |
| 7.1 | 5.6 | 7.1.6 | 725c1c3a8c5d |
| mainline | 5.6 | 7.2 | 7f11e7062965 |
| cip/5.10 | 5.6 | 5.10.268-cip77 | 085a5fde5bac |
| cip/5.10-rt | 5.6 | 5.10.268-cip77-rt34 | 085a5fde5bac |
| cip/6.1 | 5.6 | 6.1.187-cip60 | 20d18a5ec6ec |
| cip/6.1-rt | 5.6 | 6.1.189-cip61-rt32 | 20d18a5ec6ec |
| cip/6.12 | 5.6 | 6.12.101-cip29 | 904367381a92 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |