CVE-2026-89524: Linux Kernel ath6kl Information Disclosure

CVE-2026-89524 Overview

CVE-2026-89524 is an integer underflow vulnerability in the Linux kernel's ath6kl wireless driver. The flaw resides in ath6kl_cfg80211_connect_event(), which subtracts fixed information element (IE) offsets from assoc_req_len and assoc_resp_len without a lower bound check. Both fields are u8, so a short association request or response causes the value to wrap to approximately 250. The kernel then treats the wrapped value as the IE length and copies that many bytes of adjacent slab memory to user space through nl80211, disclosing kernel heap contents to a local or nearby attacker.

Critical Impact
An attacker on an adjacent wireless network can trigger disclosure of kernel slab memory to user space through crafted association frames processed by the ath6kl driver.

Affected Products

Linux kernel ath6kl Wi-Fi driver (Atheros AR6003/AR6004-family chipsets)
Multiple stable kernel branches receiving the backported fix
Distributions shipping vulnerable kernel builds with CONFIG_ATH6KL enabled

Discovery Timeline

Reported by 0sec (0sec.ai) using automated source analysis
2026-09-11 - CVE-2026-89524 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89524

Vulnerability Analysis

The ath6kl_cfg80211_connect_event() function handles connect and roam events forwarded from the firmware. It expects the association request buffer to begin with a 4-byte fixed header preceding the IE list, and the association response buffer to begin with a 6-byte fixed header. To locate the IE region, the code subtracts these offsets directly from assoc_req_len (-= 4) and assoc_resp_len (-= 6).

Both length fields are u8. When the firmware event supplies a length shorter than the corresponding fixed offset, the subtraction underflows and the value wraps to a large positive number near 250. The code then passes the wrapped length to cfg80211_connect_result() or cfg80211_roamed(), which forward the value to nl80211 and copy that many bytes from the small assoc_info buffer into a netlink message delivered to user space. The result is a linear read past the intended buffer, exposing adjacent slab memory to any process able to receive the netlink event.

Root Cause

The root cause is a missing lower-bound check on u8 length fields before arithmetic subtraction. An aggregate upper-bound check was previously added to ath6kl_wmi_connect_event_rx(), but that check does not validate that each individual length meets its minimum fixed-offset size. The unsigned integer underflow qualifies as an Input Validation Error leading to Out-of-Bounds Read and Information Disclosure.

Attack Vector

Exploitation requires an attacker positioned on an adjacent wireless network able to influence the association exchange observed by an ath6kl-based client. A malicious or spoofed access point can produce association request or response frames short enough that the firmware forwards a WMI connect event with assoc_req_len < 4 or assoc_resp_len < 6. The resulting kernel memory disclosure can include cryptographic material, pointers useful for defeating KASLR, or other sensitive slab data. See the kernel patch commit 225587b for the corrective clamp logic.

Detection Methods for CVE-2026-89524

Indicators of Compromise

Unexpected nl80211CMD_CONNECT or CMD_ROAM messages carrying oversized IE payloads on hosts using ath6kl hardware
Kernel log entries from the ath6kl driver referencing unusually short association frames or malformed connect events
Presence of rogue or spoofed access points advertising SSIDs targeted at users of AR6003/AR6004 chipset devices

Detection Strategies

Inventory Linux endpoints and embedded devices that load the ath6kl_core, ath6kl_sdio, or ath6kl_usb modules and correlate against patched kernel versions
Monitor wireless telemetry for association attempts that terminate with anomalously small frame lengths originating from unfamiliar BSSIDs
Instrument kernel builds with KASAN in test environments to catch out-of-bounds reads in cfg80211_connect_result() and cfg80211_roamed() code paths

Monitoring Recommendations

Ingest kernel and wpa_supplicant logs into a centralized analytics platform to alert on repeated connect failures against ath6kl interfaces
Track wireless intrusion detection alerts for rogue APs in proximity to fleets known to run Atheros AR6003/AR6004 hardware
Watch for processes with CAP_NET_ADMIN receiving unusually large nl80211 payloads on affected systems

How to Mitigate CVE-2026-89524

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all systems using the ath6kl driver
Identify embedded and IoT devices with AR6003/AR6004 radios and prioritize firmware or kernel updates from the device vendor
Restrict client devices from auto-associating with untrusted or open wireless networks until patches are deployed

Patch Information

The fix clamps assoc_req_len and assoc_resp_len to their respective fixed offsets before the subtraction, preventing the u8 underflow. Backports are available across multiple stable branches, including commits 225587b, 3bbd057, 6deb4d7, 8eb7301, d337213, e11d5ae, e1330d7, and e3619be.

Workarounds

Blacklist the ath6kl_core, ath6kl_sdio, and ath6kl_usb kernel modules on hosts that do not require Atheros AR6003/AR6004 wireless connectivity
Configure wpa_supplicant and NetworkManager to connect only to known, trusted SSIDs with strong authentication (WPA2-Enterprise or WPA3)
Physically disable or remove affected wireless radios on high-value systems until patched kernels are installed

bash

# Prevent the vulnerable driver from loading until the kernel is patched
echo 'blacklist ath6kl_core' | sudo tee /etc/modprobe.d/ath6kl.conf
echo 'blacklist ath6kl_sdio' | sudo tee -a /etc/modprobe.d/ath6kl.conf
echo 'blacklist ath6kl_usb'  | sudo tee -a /etc/modprobe.d/ath6kl.conf
sudo update-initramfs -u
sudo modprobe -r ath6kl_usb ath6kl_sdio ath6kl_core 2>/dev/null