Linux Kernel ath6kl EUVD-2026-55454

The ath6kl driver (drivers/net/wireless/ath/ath6kl/) implements the host-side WMI (Wireless Management Interface) protocol for Qualcomm Atheros AR6xxx embedded WiFi chipsets, commonly found in IoT devices, older Chromebooks, and embedded Linux platforms. The vulnerable function ath6kl_wmi_tx_complete_event_rx() processes TX completion events received from the on-chip firmware over the WMI channel. The firmware populates a num_msg field of type u8 (up to 255) that tells the kernel how many TX completion records follow in the buffer. The driver loops num_msg times reading fixed-size entries without first verifying that the buffer contains at least sizeof(fixed_header) + num_msg * sizeof(entry) bytes. A firmware that supplies an inflated num_msg - whether due to compromise, emulation of a rogue AP, or crafted 802.11 protocol responses - causes up to 1020 bytes of kernel memory beyond the allocated WMI event buffer to be accessed. The root cause maps to CWE-125 (Out-of-Bounds Read), though the CVE record lists no CWE. The CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covering the broad Linux kernel tree from 3.2 onward.