« Volver al listado

CVE-2026-68355

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()

When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow.

Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68355",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "lessThan": "085a5fde5bac29c01059e69399b417e91c0a6c18",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "lessThan": "31ea4b175bc3ab430be15834d9ee8a1ce65bee15",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "lessThan": "20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "lessThan": "69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "lessThan": "904367381a922aa2dc3e8bd2488e6c9180516c7a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "lessThan": "a154ca3c441a67d36b3a9ea63a4f11b06abe6223",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "lessThan": "725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "lessThan": "7f11e70629650ff6ea140984e5ce188b775b2683",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/dp_rx.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/dp_rx.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:27.940",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/085a5fde5bac29c01059e69399b417e91c0a6c18",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/31ea4b175bc3ab430be15834d9ee8a1ce65bee15",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7f11e70629650ff6ea140984e5ce188b775b2683",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/904367381a922aa2dc3e8bd2488e6c9180516c7a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a154ca3c441a67d36b3a9ea63a4f11b06abe6223",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()\n\nWhen the first entry in msdu_details has a zero buffer address,\nthe code accesses msdu_details[i - 1] with i == 0, causing a\nbuffer underflow.\n\nFix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding\na separate check for i == 0 before the main condition to prevent\nthe out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
    }
  ],
  "lastModified": "2026-08-19T17:20:45.190",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}