Executive brief
The ath6kl WiFi driver in the Linux kernel contains an integer underflow vulnerability when processing WiFi association responses. When the driver receives malformed or truncated WiFi frame data, unsigned integer variables wrap around to large values, causing the kernel to copy excessive amounts of adjacent memory to user space. This could allow an attacker to leak sensitive kernel memory contents from a system connected to a malicious WiFi access point.
Technical details
The vulnerability exists in ath6kl_cfg80211_connect_event() in drivers/net/wireless/ath/ath6kl/cfg80211.c. The function subtracts fixed offsets (4 and 6 bytes) from unsigned 8-bit length variables (assoc_req_len and assoc_resp_len) without validating that the lengths are at least as large as the offsets. When a length is smaller than its offset, the u8 underflows and wraps to approximately 250. This wrapped value is then used as an IE (Information Element) length by cfg80211_connect_result() and cfg80211_roamed(), causing them to copy up to 250 bytes of slab memory out of a small assoc_info buffer to user space via nl80211, leaking kernel memory. The fix clamps both lengths to their minimum offsets before performing the subtraction. Network reachability to a malicious WiFi access point is required; no authentication or user interaction is needed.
Affected products
- Linux Linux kernel all versions (patch available in linux-6.1.y, linux-6.9.y, linux-7.0.y and later)
Timeline
- 2026-09-11: disclosed: CVE-2026-89524 published
- 2026-07-31: patched: Upstream fix merged by Jeff Johnson
- 2026-09-14: patched: Patch merged into linux-6.1.y stable tree by Greg Kroah-Hartman