HIGH Introduced in 3.2
ath6kl WmiEvent OOB
CVE-2026-92498
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event: ath6kl_wmi_scan_complete_rx() ath6kl_wmi_addba_req_event_rx() ath6kl_wmi_delba_req_event_rx() Add length checks to prevent overread.
02KernelScan AI Analysis
Risk summary
The ath6kl WiFi driver's WMI event handlers process incoming wireless management frames without validating that the event buffer is large enough to hold the expected structure. An attacker within wireless range of a device using an ath6kl-based WiFi adapter could send crafted WMI events to trigger out-of-bounds reads, potentially leaking kernel memory or causing a denial of service.
Vulnerability analysis
Three WMI event handlers in the ath6kl WiFi driver read structured data from the event buffer without first checking that the buffer is large enough to contain the expected event structure. A short or malformed WMI event received from the wireless firmware path causes the driver to read past the end of the supplied buffer. The fix adds a length check at the top of each handler that rejects events smaller than the expected structure size before any fields are accessed. The vulnerable code path is reached when the ath6kl driver processes incoming WMI events from the wireless interface, meaning an attacker within WiFi range of a device using an ath6kl-based adapter can trigger the overread by sending crafted wireless frames.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.2 | 5.10.270 | 144fe0b0fa8f |
| 5.15 | 3.2 | 5.15.221 | a2de3fb4f83a |
| 6.1 | 3.2 | 6.1.188 | d1d2ac5f5b16 |
| 6.12 | 3.2 | 6.12.110 | 41159d392c3a |
| 6.18 | 3.2 | 6.18.52 | abda58f4529d |
| 6.6 | 3.2 | 6.6.157 | ea2a77682f9f |
| 7.2 | 3.2 | 7.2.6 | 2f3635213ecf |
| mainline | 3.2 | 7.3 | f57314aade9d |
| cip/5.10 | 3.2 | 5.10.271-cip78 | 144fe0b0fa8f |
| cip/6.1 | 3.2 | 6.1.189-cip61 | d1d2ac5f5b16 |
| cip/6.1-rt | 3.2 | 6.1.189-cip61-rt32 | d1d2ac5f5b16 |
| cip/6.12 | 3.2 | 6.12.111-cip32 | 41159d392c3a |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |