CVE-2026-68353

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. The ath6kl_wmi_tx_complete_event_rx() function, responsible for handling Wi-Fi messages, does not properly validate the num_msg field provided by the firmware against the buffer length. A malicious or compromised firmware could send an inflated num_msg value, leading to an out-of-bounds read of up to 1020 bytes past the allocated buffer. This could result in information disclosure or potentially a denial of service.

This issue affects Qualcomm ath6kl Wi-Fi. TX complete handler loops on firmware num_msg without buffer bounds check, allowing large OOB reads. Systems without ath6kl hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ath6kl module from loading. See https://access.redhat.com/solutions/41278 for instructions.