CVE-2026-68353 wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
A malicious firmware can trigger an out-of-bounds read in the ath6kl Wi-Fi driver, potentially leaking kernel memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68353?
CVE-2026-68353 is a high-severity memory corruption vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buffer length. This allows out-of-bounds reads of up to 1020 bytes past the WMI event buffer when the firmware sends an inflated num_msg.
Add a check that the buffer is large enough to hold the fixed struct and the num_msg variable-length entries.
Weakness: CWE-125
Which versions are affected by CVE-2026-68353?
How do I fix CVE-2026-68353?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68353 being exploited?
There is no known exploitation of CVE-2026-68353 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68353, DEBIAN-CVE-2026-68353, GHSA-2244-8pcv-8jr6, UBUNTU-CVE-2026-68353.