EUVD-2026-76430
GHSA-5r7p-vjpr-vvgf
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Adjacent WiFi access required (AV:A); rogue AP triggers underflow without victim auth; C:H for kernel slab disclosure; A:H for potential OOB-read-induced crash.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower bound. The aggregate check recently added to ath6kl_wmi_connect_event_rx() bounds the declared lengths from above (their sum must fit the received event), but an assoc request/response shorter than its fixed offset still underflows here: the u8 wraps to ~250, and cfg80211_connect_result() / cfg80211_roamed() then treat that wrapped value as the IE length and copy that many bytes out of the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory.
Clamp both lengths to their offsets before subtracting.
Found by 0sec (https://0sec.ai) using automated source analysis; the missing lower bound is evident from source. Compile-tested.
AnalysisAI
Integer underflow in the ath6kl WiFi driver's ath6kl_cfg80211_connect_event() allows an adjacent-network attacker controlling a rogue access point to trigger disclosure of kernel slab memory to userspace via nl80211. When a crafted association response shorter than 6 bytes (or request shorter than 4 bytes) is received from firmware, the u8 length fields wrap around to approximately 250, causing cfg80211_connect_result() or cfg80211_roamed() to copy ~250 bytes of adjacent slab data through netlink to any listening userspace process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be within WiFi radio range of the victim device and to operate or emulate a WiFi access point that the victim associates with (AV:A). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) accurately reflects the adjacent-network attack surface and high confidentiality impact from kernel memory disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Linux kernel to version 6.12.109 or later on the 6.12 LTS branch, 6.18.50 or later on the 6.18 branch, or 7.2.4 or later on the 7.2 branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No public exploit identified at time of analysis, but this memory disclosure vulnerability warrants prioritized remediation given its CVSS 8.1 severity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today