{"id":"CVE-2026-68355","title":"wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()\n\nWhen the first entry in msdu_details has a zero buffer address,\nthe code accesses msdu_de…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 085a5fde5bac29c01059e69399b417e91c0a6c18","Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 31ea4b175bc3ab430be15834d9ee8a1ce65bee15","Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591","Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a","Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 904367381a922aa2dc3e8bd2488e6c9180516c7a","Linux >= d5c65159f2895379e11ca13f62feabe93278985d < a154ca3c441a67d36b3a9ea63a4f11b06abe6223","Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5","Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 7f11e70629650ff6ea140984e5ce188b775b2683","Linux 5.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:48:00.630554Z"},"published":"2026-08-10","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:14.218Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68355","references":[{"url":"https://git.kernel.org/stable/c/085a5fde5bac29c01059e69399b417e91c0a6c18"},{"url":"https://git.kernel.org/stable/c/31ea4b175bc3ab430be15834d9ee8a1ce65bee15"},{"url":"https://git.kernel.org/stable/c/20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591"},{"url":"https://git.kernel.org/stable/c/69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a"},{"url":"https://git.kernel.org/stable/c/904367381a922aa2dc3e8bd2488e6c9180516c7a"},{"url":"https://git.kernel.org/stable/c/a154ca3c441a67d36b3a9ea63a4f11b06abe6223"},{"url":"https://git.kernel.org/stable/c/725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5"},{"url":"https://git.kernel.org/stable/c/7f11e70629650ff6ea140984e5ce188b775b2683"}],"tags":["cve.org"],"epss":0.00184,"epssPercentile":0.08081,"ingestedAt":"2026-11-06T18:00:12.608Z","slug":"CVE-2026-68355","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()\n\nWhen the first entry in msdu_details has a zero buffer address,\nthe code accesses msdu_details[i - 1] with i == 0, causing a\nbuffer underflow.\n\nFix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding\na separate check for i == 0 before the main condition to prevent\nthe out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n## Affected\n\n- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 085a5fde5bac29c01059e69399b417e91c0a6c18`\n- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 31ea4b175bc3ab430be15834d9ee8a1ce65bee15`\n- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591`\n- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a`\n- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 904367381a922aa2dc3e8bd2488e6c9180516c7a`\n- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < a154ca3c441a67d36b3a9ea63a4f11b06abe6223`\n- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5`\n- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 7f11e70629650ff6ea140984e5ce188b775b2683`\n- `Linux 5.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}