CVE-2026-89524

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from

assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower

bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()

bounds the declared lengths from above (their sum must fit the received

event), but an assoc request/response shorter than its fixed offset still

underflows here: the u8 wraps to ~250, and cfg80211_connect_result() /

cfg80211_roamed() then treat that wrapped value as the IE length and copy

that many bytes out of the small assoc_info buffer to user space via

nl80211, disclosing adjacent slab memory.

Clamp both lengths to their offsets before subtracting.

Found by 0sec (https://0sec.ai) using automated source analysis; the

missing lower bound is evident from source. Compile-tested.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References