{"id":"CVE-2026-89524","title":"wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets\n\nath6kl_cfg80211_connect_event() subtracts fixed IE offsets from\nassoc_req_len (-= 4) a…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Linux","product":"Linux","affected":["Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 225587bdbf4b0eb5265a71ee4dc183561a1857fc","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < d337213a889705a69735079606d0b4c672b17605","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < e11d5ae96d5e52cb48fa27c6ad352d766d0322fb","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < e3619bed5da125713b29ac881dc66f5e06606f88","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < e1330d719c047c4d8190a16be034b29fc601a815","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 8eb73016fb3968cf2db3987a92764563a3af773a","Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 3bbd05723d15dd06f0560bcd94fbf9a91b5f5613","Linux 3.2"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:48:15.538Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89524","references":[{"url":"https://git.kernel.org/stable/c/225587bdbf4b0eb5265a71ee4dc183561a1857fc"},{"url":"https://git.kernel.org/stable/c/d337213a889705a69735079606d0b4c672b17605"},{"url":"https://git.kernel.org/stable/c/e11d5ae96d5e52cb48fa27c6ad352d766d0322fb"},{"url":"https://git.kernel.org/stable/c/6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9"},{"url":"https://git.kernel.org/stable/c/e3619bed5da125713b29ac881dc66f5e06606f88"},{"url":"https://git.kernel.org/stable/c/e1330d719c047c4d8190a16be034b29fc601a815"},{"url":"https://git.kernel.org/stable/c/8eb73016fb3968cf2db3987a92764563a3af773a"},{"url":"https://git.kernel.org/stable/c/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89524.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89524"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532320"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89524"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89524"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89524.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00274,"epssPercentile":0.19658,"scores":{"cna":8.1,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.452Z","slug":"CVE-2026-89524","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets\n\nath6kl_cfg80211_connect_event() subtracts fixed IE offsets from\nassoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower\nbound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()\nbounds the declared lengths from above (their sum must fit the received\nevent), but an assoc request/response shorter than its fixed offset still\nunderflows here: the u8 wraps to ~250, and cfg80211_connect_result() /\ncfg80211_roamed() then treat that wrapped value as the IE length and copy\nthat many bytes out of the small assoc_info buffer to user space via\nnl80211, disclosing adjacent slab memory.\n\nClamp both lengths to their offsets before subtracting.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing lower bound is evident from source. Compile-tested.\n\n## Affected\n\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 225587bdbf4b0eb5265a71ee4dc183561a1857fc`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < d337213a889705a69735079606d0b4c672b17605`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < e11d5ae96d5e52cb48fa27c6ad352d766d0322fb`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < e3619bed5da125713b29ac881dc66f5e06606f88`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < e1330d719c047c4d8190a16be034b29fc601a815`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 8eb73016fb3968cf2db3987a92764563a3af773a`\n- `Linux >= bdcd81707973cf8aa9305337166f8ee842a050d4 < 3bbd05723d15dd06f0560bcd94fbf9a91b5f5613`\n- `Linux 3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89524.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":224721,"id":"CVE-2026-89524","ts":1792401500332,"field":"cvss","old":"5.5","new":"8.1"},{"seq":224720,"id":"CVE-2026-89524","ts":1792401500332,"field":"severity","old":"medium","new":"high"},{"seq":205452,"id":"CVE-2026-89524","ts":1789576718924,"field":"cvss","old":"8.1","new":"5.5"},{"seq":205451,"id":"CVE-2026-89524","ts":1789576718924,"field":"severity","old":"high","new":"medium"},{"seq":197973,"id":"CVE-2026-89524","ts":1789384321209,"field":"cvss","old":"6.4","new":"8.1"},{"seq":197972,"id":"CVE-2026-89524","ts":1789384321209,"field":"severity","old":"medium","new":"high"},{"seq":183768,"id":"CVE-2026-89524","ts":1789356677305,"field":"cvss","old":"8.1","new":"6.4"},{"seq":183767,"id":"CVE-2026-89524","ts":1789356677305,"field":"severity","old":"high","new":"medium"},{"seq":153316,"id":"CVE-2026-89524","ts":1789285350015,"field":"cvss","old":null,"new":"8.1"},{"seq":153315,"id":"CVE-2026-89524","ts":1789285350015,"field":"severity","old":"none","new":"high"},{"seq":147385,"id":"CVE-2026-89524","ts":1789270210696,"field":"cvss","old":null,"new":"6.4"},{"seq":147384,"id":"CVE-2026-89524","ts":1789270210696,"field":"severity","old":"none","new":"medium"},{"seq":109141,"id":"CVE-2026-89524","ts":1789183730470,"field":"cvss","old":null,"new":"6.4"},{"seq":109140,"id":"CVE-2026-89524","ts":1789183730470,"field":"severity","old":"none","new":"medium"}]}