CVE-2026-68355: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68355 Overview

CVE-2026-68355 is a buffer underflow vulnerability in the Linux kernel's ath11k Wi-Fi driver. The flaw resides in the ath11k_hal_rx_msdu_list_get() function, which processes received MAC Service Data Unit (MSDU) descriptor lists. When the first entry in msdu_details contains a zero buffer address, the function accesses msdu_details[i - 1] with i == 0, producing an out-of-bounds read before the start of the array.

The issue was found by the Linux Verification Center (linuxtesting.org) using the SVACE static analyzer and has been resolved upstream through multiple stable-tree commits.

Critical Impact
A malformed hardware descriptor list can trigger an out-of-bounds memory read in kernel context, risking memory disclosure or kernel instability on systems using Qualcomm ath11k Wi-Fi hardware.

Affected Products

Linux kernel — ath11k wireless driver (Qualcomm Wi-Fi 6/6E chipsets)
Distributions shipping vulnerable kernel versions prior to the referenced stable patches
Devices utilizing Qualcomm QCA6390, WCN6855, and related ath11k-supported chipsets

Discovery Timeline

2026-08-10 - CVE-2026-68355 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68355

Vulnerability Analysis

The ath11k_hal_rx_msdu_list_get() function iterates over an array of MSDU descriptors returned from the wireless hardware. During iteration, the code inspects the buffer address associated with each descriptor entry to determine whether the current MSDU continues from a previous fragment. To perform this check, it references the prior element at index i - 1.

When the very first entry (i == 0) contains a zero buffer address, the check-path still evaluates msdu_details[i - 1], which points to memory located immediately before the array. This is a classic buffer underflow arising from missing lower-bound validation on the loop index.

The upstream fix mirrors the pattern already used in ath12k_wifi7_hal_rx_msdu_list_get(), adding an explicit i == 0 guard before the main condition to prevent the out-of-bounds access.

Root Cause

The root cause is missing input validation on the loop index prior to dereferencing the previous array element. The code assumes at least one prior descriptor exists whenever the zero-address condition holds, an assumption violated when the malformed entry appears first in the list.

Attack Vector

Triggering the flaw requires the Wi-Fi hardware or firmware to deliver an MSDU descriptor list whose first entry carries a zero buffer address. This can occur through faulty firmware states, hardware error conditions, or potentially through crafted radio frames that induce anomalous descriptor ring content. The out-of-bounds read executes in kernel context and may leak memory contents into subsequent processing paths or cause driver misbehavior.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-68355

Indicators of Compromise

Unexpected kernel warnings, oops messages, or panics referencing ath11k_hal_rx_msdu_list_get in dmesg output
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads within the ath11k receive path
Wireless interface instability, unexpected driver resets, or repeated firmware crash-recovery events on ath11k-based adapters

Detection Strategies

Audit installed kernel versions against the fixed commits 69a6a4f, 725c1c3, 7f11e70, 9043673, and a154ca3 referenced in the kernel.org stable tree
Inventory endpoints and IoT devices using Qualcomm ath11k Wi-Fi chipsets to scope exposure
Enable KASAN in test and staging environments to surface out-of-bounds accesses during driver exercise

Monitoring Recommendations

Forward kernel logs (/var/log/kern.log, journald) to a centralized logging pipeline and alert on ath11k crash signatures
Track wireless driver reset counters and firmware recovery events across managed fleets
Correlate wireless subsystem faults with proximity to untrusted access points or unusual RF activity

How to Mitigate CVE-2026-68355

Immediate Actions Required

Apply the latest stable kernel update from your Linux distribution that incorporates the ath11k underflow fix
Prioritize patching on laptops, embedded devices, and access points using Qualcomm ath11k radios
Verify Wi-Fi firmware images are current, as firmware quality directly influences whether malformed descriptor conditions arise

Patch Information

The fix has been merged into the Linux stable tree across multiple maintained branches. Reference commits include 69a6a4f, 725c1c3, 7f11e70, 9043673, and a154ca3. Consume the fix through your distribution's kernel package updates rather than patching manually where possible.

Workarounds

Disable the ath11k module (modprobe -r ath11k_pci ath11k) on systems where Wi-Fi is not required until a patched kernel is deployed
Restrict operation to trusted wireless networks to reduce exposure to anomalous descriptor conditions influenced by hostile RF environments
Where feasible, use wired networking on high-value hosts until the patched kernel is rolled out

bash

# Check running kernel and ath11k module status
uname -r
lsmod | grep ath11k

# Temporarily unload the driver until patched
sudo modprobe -r ath11k_pci ath11k

# Prevent automatic load until the system is updated
echo 'blacklist ath11k' | sudo tee /etc/modprobe.d/blacklist-ath11k.conf
echo 'blacklist ath11k_pci' | sudo tee -a /etc/modprobe.d/blacklist-ath11k.conf