CVE-2026-68352: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68352 Overview

CVE-2026-68352 is an out-of-bounds read vulnerability in the Linux kernel's ath6kl Wi-Fi driver. The flaw resides in the ath6kl_wmi_connect_event_rx() function, which processes connect events from Atheros 6000-series wireless firmware. Firmware-controlled length fields including beacon_ie_len, assoc_req_len, and assoc_resp_len are not validated against the event buffer size. Their combined value can reach 765 bytes and exceed the actual WMI event data, triggering out-of-bounds reads during Information Element (IE) parsing. The condition also corrupts the wmi->is_wmm_enabled state variable.

Critical Impact
A malicious or compromised firmware image, or an attacker able to influence WMI event data on an adjacent wireless network, can cause kernel memory disclosure and driver state corruption on systems using the ath6kl driver.

Affected Products

Linux kernel builds that include the ath6kl wireless driver
Devices using Qualcomm Atheros AR6003/AR6004 chipsets managed by ath6kl
Distributions shipping kernels prior to the fixes referenced in the upstream stable tree

Discovery Timeline

2026-08-10 - CVE-2026-68352 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68352

Vulnerability Analysis

The ath6kl driver receives WMI (Wireless Module Interface) events from firmware, including a connect event that reports the Information Elements observed during association. The connect event structure carries three length fields describing the beacon IE, association request IE, and association response IE regions appended to the event payload.

The handler ath6kl_wmi_connect_event_rx() reads these firmware-supplied fields and iterates over the IE data without first comparing their sum to the remaining buffer length. Because each field is up to 255 bytes wide, their combined maximum reaches 765 bytes, which can exceed the actual event size delivered by the driver.

Parsing then advances the read pointer past the valid buffer boundary, causing kernel out-of-bounds reads and corrupting the driver's is_wmm_enabled tracking flag. This is classified as an out-of-bounds read [CWE-125] driven by improper input validation of firmware-supplied length data.

Root Cause

The root cause is missing bounds validation. The driver trusts firmware-supplied length fields without ensuring that beacon_ie_len + assoc_req_len + assoc_resp_len fits within the received WMI event buffer. The upstream fix adds an explicit total-length check before IE parsing proceeds.

Attack Vector

Exploitation requires adjacency to the target, consistent with an attack vector reachable from the wireless medium or from a compromised firmware supply chain. An attacker who can influence the WMI connect event, either by tampering with firmware, injecting crafted frames processed by firmware, or operating a rogue access point that causes the firmware to emit malformed IE lengths, can trigger the out-of-bounds read on the host kernel. The result is kernel memory disclosure and corruption of Wi-Fi state, with high confidentiality and availability impact.

No public proof-of-concept exploit is currently available for CVE-2026-68352. See the upstream kernel patches for the exact code changes.

Detection Methods for CVE-2026-68352

Indicators of Compromise

Unexpected kernel messages referencing ath6kl_wmi_connect_event_rx or malformed WMI connect events
KASAN or slab-out-of-bounds reports naming the ath6kl module during Wi-Fi association
Wi-Fi Multimedia (WMM) behavior toggling unexpectedly, consistent with corruption of wmi->is_wmm_enabled
Repeated association failures or driver resets triggered by nearby wireless activity

Detection Strategies

Inventory kernels and device trees for the presence of the ath6kl driver and AR6003/AR6004 chipsets
Compare running kernel versions against the fixed commits listed in the stable tree references
Enable kernel address sanitizer (KASAN) on test systems to surface the out-of-bounds read during association
Correlate wireless-driver crash telemetry with proximity events from Wi-Fi infrastructure logs

Monitoring Recommendations

Forward dmesg and journald kernel logs to a central analytics platform for anomaly review
Alert on repeated ath6kl warnings, oops entries, or module reloads on production endpoints
Track association events from unknown or unauthorized SSIDs targeting affected hardware

How to Mitigate CVE-2026-68352

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix for ath6kl_wmi_connect_event_rx() bounds validation
Identify all systems running the ath6kl driver and prioritize patching mobile, embedded, and IoT devices using AR6003/AR6004 radios
Restrict affected devices to trusted wireless networks until patched

Patch Information

The fix adds a validation step that ensures the total IE length fits within the received buffer before parsing. The change is available in the upstream stable tree across multiple branches: 1c690f7, 33b5342, 6b47b29, 94e1bfc, and d70c0a8. Apply the vendor kernel update from your Linux distribution once it incorporates these commits.

Workarounds

Unload the ath6kl module on systems that do not require the affected Wi-Fi hardware
Disable the wireless interface bound to AR6003/AR6004 chipsets until patched firmware and kernel are deployed
Constrain client devices to known SSIDs using enterprise Wi-Fi policy to reduce exposure to rogue access points

bash

# Check for the ath6kl driver on a running system
lsmod | grep ath6kl

# Temporarily unload the driver where the hardware is not required
sudo modprobe -r ath6kl_sdio ath6kl_usb ath6kl_core

# Blocklist the driver to prevent auto-load until the kernel is patched
echo 'blacklist ath6kl_core' | sudo tee /etc/modprobe.d/ath6kl-cve-2026-68352.conf
sudo update-initramfs -u