HIGH Introduced in 3.2
ath6kl AssocInfo OOB
CVE-2026-89524
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx() bounds the declared lengths from above (their sum must fit the received event), but an assoc request/response shorter than its fixed offset still underflows here: the u8 wraps to ~250, and cfg80211_connect_result() / cfg80211_roamed() then treat that wrapped value as the IE length and copy that many bytes out of the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory. Clamp both lengths to their offsets before subtracting. Found by 0sec (https://0sec.ai) using automated source analysis; the missing lower bound is evident from source. Compile-tested.
02KernelScan AI Analysis
Risk summary
A malformed association event from a nearby Wi-Fi network can cause the ath6kl driver to underflow a length field, producing an oversized information-element length that is then used to copy adjacent slab memory out to userspace via nl80211. This can disclose kernel memory contents and may also crash the kernel. The flaw is reachable by any device using the ath6kl wireless chipset when it processes crafted association request or response frames.
Vulnerability analysis
When the ath6kl driver processes a connect event from the firmware, it subtracts a fixed offset from the association request and response lengths to isolate the information elements, but it never checks that those lengths are large enough. A short association frame causes the length to underflow to a very large value, and the driver then uses that wrapped length to copy data from a small association buffer out to userspace, reading past the buffer into adjacent kernel heap memory. The fix ensures both lengths are at least as large as their offsets before subtracting, preventing any underflow. The vulnerable path is reached when the device associates with a malicious Wi-Fi access point, so an attacker within radio range can trigger the flaw without any local account or privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.2 | 5.10.270 | 225587bdbf4b |
| 5.15 | 3.2 | 5.15.221 | d337213a8897 |
| 6.1 | 3.2 | 6.1.188 | e11d5ae96d5e |
| 6.12 | 3.2 | 6.12.109 | e3619bed5da1 |
| 6.18 | 3.2 | 6.18.50 | e1330d719c04 |
| 6.6 | 3.2 | 6.6.157 | 6deb4d7a0c3d |
| 7.2 | 3.2 | 7.2.4 | 8eb73016fb39 |
| mainline | 3.2 | 7.3 | 3bbd05723d15 |
| cip/5.10 | 3.2 | 5.10.271-cip78 | 225587bdbf4b |
| cip/6.1 | 3.2 | 6.1.189-cip61 | e11d5ae96d5e |
| cip/6.1-rt | 3.2 | 6.1.189-cip61-rt32 | e11d5ae96d5e |
| cip/6.12 | 3.2 | 6.12.111-cip32 | e3619bed5da1 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |