Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl – removed the WARN message for bad firmware inputs. If the firmware provides incorrect inputs, it has nothing to do with the driver’s stack at this point; therefore, the WARN message doesn’t add any value...

Linux Distros Unpatched Vulnerability : CVE-2026-89524

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and...

UBUNTU-CVE-2026-89524

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

CVE-2026-89524 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

CVE-2026-89524

CVE-2026-89524 is an integer underflow in the Linux kernel's ath6kl Wi-Fi driver . In ath6kl_cfg80211_connect_event(), fixed IE offsets are subtracted from assoc_req_len (−4) and assoc_resp_len (−6), both of type u8, with no lower-bound check. When an association request or response is shorter th...

ROS-20260826-73-0008

The vulnerability of the ath6klhtcpiperxcomplete function in the drivers/net/wireless/ath/ath6kl/htcpipe.c file of the Atheros/Qualcomm wireless adapter driver in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow...

SUSE CVE-2026-68353

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx without validation against the buffer length. This allows...

CVE-2026-68352

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. The driver does not properly validate the lengths of firmware-controlled information elements IEs during a connect event. This vulnerability allows the sum of these lengths to exceed the allocated buffer, resulting in an out-of-bounds...

CVE-2026-68198

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. A use-after-free vulnerability exists within the aggrresetstate function. This occurs because a non-synchronous timer deletion allows a timer callback aggrtimeout to access memory that has already been freed, creating a race condition. A...

CVE-2026-68199

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. This vulnerability allows a local attacker to cause an out-of-bounds memory access. The flaw occurs when the firmware provides an invalid window size during an ADDBA Add Block Ack request, leading to incorrect memory allocation. This can...

CVE-2026-68199

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggrrecvaddbareqevt logs a debug message when the firmware-supplied winsz is outside AGGRWINSZMIN, AGGRWINSZMAX but does not return. The out-of-range winsz is then used...

CVE-2026-68352 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

CVE-2026-68199 wifi: ath6kl: fix OOB access from firmware ADDBA window size

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggrrecvaddbareqevt logs a debug message when the firmware-supplied winsz is outside AGGRWINSZMIN, AGGRWINSZMAX but does not return. The out-of-range winsz is then used...

CVE-2026-68199 wifi: ath6kl: fix OOB access from firmware ADDBA window size

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggrrecvaddbareqevt logs a debug message when the firmware-supplied winsz is outside AGGRWINSZMIN, AGGRWINSZMAX but does not return. The out-of-range winsz is then used...

PT-2026-69599

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the ath6kl wifi driver. The function aggr recv addba req evt fails to return when the firmware-supplied win sz variable is outside the valid range...

PT-2026-69752

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the ath6kl wmi connect event rx function. The firmware-controlled fields beacon ie len, assoc req len, and assoc resp len are not validated against the...

Linux Distros Unpatched Vulnerability : CVE-2026-68198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath6kl: fix use-after-free in aggrresetstate The aggrresetstate function uses timerdelete non-synchronous for the aggregation timer before proceeding to...

PT-2026-69753

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the ath6kl wmi tx complete event rx function. The issue occurs because the num msg field, which is controlled by the firmware, drives a loop without being...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003994)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003994 advisory. An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6klwmipstreamtimeouteventrx and ath6klwmicaceventrx in the...

DEBIAN-CVE-2025-38406

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: remove WARN on bad firmware input If the firmware gives bad input, that's nothing to do with the driver's stack at this point etc., so the WARNON doesn't add any value. Additionally, this is one of the top syzbot...