Executive brief
The Linux kernel's ath6kl WiFi driver processes wireless management interface (WMI) event messages without validating message length, allowing a local or remote attacker to trigger out-of-bounds memory reads. Depending on the deployment context, this could lead to information disclosure or kernel crash.
Technical details
The vulnerability is a buffer overread (CWE-126) in three WMI event handler functions: ath6kl_wmi_scan_complete_rx(), ath6kl_wmi_addba_req_event_rx(), and ath6kl_wmi_delba_req_event_rx(). These functions cast incoming event buffer data to fixed-size structures without first checking whether the buffer is large enough to contain the expected structure. An attacker sending a malformed or truncated WMI event can cause the driver to read past the buffer boundary, potentially leaking kernel memory or causing a denial-of-service crash. The fix adds length validation checks before structure casting. Attack vector depends on the ath6kl device type and firmware configuration; it may require network access or device-level proximity.
Affected products
- Linux Linux kernel multiple versions prior to patch f57314aade9d74d30f3360ec5ef85a83654748be
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Fix committed upstream; backported to multiple stable branches