{"api_version":"1","generated_at":"2026-09-14T15:57:32+00:00","cve":"CVE-2026-89524","urls":{"html":"https://cve.report/CVE-2026-89524","api":"https://cve.report/api/cve/CVE-2026-89524.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89524","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89524"},"summary":{"title":"wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets\n\nath6kl_cfg80211_connect_event() subtracts fixed IE offsets from\nassoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower\nbound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()\nbounds the declared lengths from above (their sum must fit the received\nevent), but an assoc request/response shorter than its fixed offset still\nunderflows here: the u8 wraps to ~250, and cfg80211_connect_result() /\ncfg80211_roamed() then treat that wrapped value as the IE length and copy\nthat many bytes out of the small assoc_info buffer to user space via\nnl80211, disclosing adjacent slab memory.\n\nClamp both lengths to their offsets before subtracting.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing lower bound is evident from source. Compile-tested.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:35","updated_at":"2026-09-14 13:19:08"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","data":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9","name":"https://git.kernel.org/stable/c/6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e1330d719c047c4d8190a16be034b29fc601a815","name":"https://git.kernel.org/stable/c/e1330d719c047c4d8190a16be034b29fc601a815","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8eb73016fb3968cf2db3987a92764563a3af773a","name":"https://git.kernel.org/stable/c/8eb73016fb3968cf2db3987a92764563a3af773a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d337213a889705a69735079606d0b4c672b17605","name":"https://git.kernel.org/stable/c/d337213a889705a69735079606d0b4c672b17605","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/225587bdbf4b0eb5265a71ee4dc183561a1857fc","name":"https://git.kernel.org/stable/c/225587bdbf4b0eb5265a71ee4dc183561a1857fc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e3619bed5da125713b29ac881dc66f5e06606f88","name":"https://git.kernel.org/stable/c/e3619bed5da125713b29ac881dc66f5e06606f88","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613","name":"https://git.kernel.org/stable/c/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e11d5ae96d5e52cb48fa27c6ad352d766d0322fb","name":"https://git.kernel.org/stable/c/e11d5ae96d5e52cb48fa27c6ad352d766d0322fb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89524","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89524","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 225587bdbf4b0eb5265a71ee4dc183561a1857fc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 d337213a889705a69735079606d0b4c672b17605 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 e11d5ae96d5e52cb48fa27c6ad352d766d0322fb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 e3619bed5da125713b29ac881dc66f5e06606f88 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 e1330d719c047c4d8190a16be034b29fc601a815 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 8eb73016fb3968cf2db3987a92764563a3af773a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 3bbd05723d15dd06f0560bcd94fbf9a91b5f5613 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.2","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.2 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.270 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.221 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.109 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"89524","cve":"CVE-2026-89524","epss":"0.002550000","percentile":"0.171770000","score_date":"2026-09-13","updated_at":"2026-09-14 00:18:01"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ath/ath6kl/cfg80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"225587bdbf4b0eb5265a71ee4dc183561a1857fc","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"d337213a889705a69735079606d0b4c672b17605","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"e11d5ae96d5e52cb48fa27c6ad352d766d0322fb","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"e3619bed5da125713b29ac881dc66f5e06606f88","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"e1330d719c047c4d8190a16be034b29fc601a815","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"8eb73016fb3968cf2db3987a92764563a3af773a","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"3bbd05723d15dd06f0560bcd94fbf9a91b5f5613","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ath/ath6kl/cfg80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.270","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.109","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.270","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.221","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.109","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"3.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets\n\nath6kl_cfg80211_connect_event() subtracts fixed IE offsets from\nassoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower\nbound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()\nbounds the declared lengths from above (their sum must fit the received\nevent), but an assoc request/response shorter than its fixed offset still\nunderflows here: the u8 wraps to ~250, and cfg80211_connect_result() /\ncfg80211_roamed() then treat that wrapped value as the IE length and copy\nthat many bytes out of the small assoc_info buffer to user space via\nnl80211, disclosing adjacent slab memory.\n\nClamp both lengths to their offsets before subtracting.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing lower bound is evident from source. Compile-tested."}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:A - ath6kl is a fullMAC WiFi driver; assoc_req_len/assoc_resp_len come from a WMI_CONNECT_EVENT built from the 802.11 association exchange. A rogue or evil-twin AP, or a frame injector in radio range, supplies a truncated assoc/reassoc response, so the attacker must share the wireless segment.\nAC:L - A malicious AP can send a truncated association or reassociation response so firmware reports assoc_req_len < 4 or assoc_resp_len < 6. The u8 subtraction wraps deterministically and cfg80211 copies the wrapped length; the attacker can force (re)association or roaming with deauth until the event is emitted.\nPR:N - The WMI connect event is handled on the firmware receive path with no capability check, local account, or user-namespace gate. An adjacent attacker needs no privileges on the victim system.\nUI:N - Devices with a saved or open profile auto-associate, and the SME_CONNECTED roam path (cfg80211_roamed) delivers the same underflowed IEs while already connected, so no extra victim action is required.\nS:U - The out-of-bounds read, kernel-memory disclosure, and any resulting oops stay inside the host kernel's security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - After the u8 wrap, cfg80211_connect_result()/cfg80211_roamed() treat ~250-byte lengths as IE sizes and copy that many bytes from the small assoc_info skb into nl80211 CONNECT/ROAM events (and WEXT assoc IE events), disclosing adjacent slab memory far beyond a few bytes.\nI:N - The underflow only inflates the length used for an out-of-bounds read and copy to userspace; no kernel memory is written out of bounds and no attacker-controlled pointer is used to modify kernel state.\nA:H - Copying ~250 bytes past a short WMI skb can walk off the slab object into unmapped or redzoned memory, causing a kernel oops or KASAN panic that an adjacent attacker can retrigger by repeating association."}]}],"providerMetadata":{"dateUpdated":"2026-09-14T12:00:40.689Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/225587bdbf4b0eb5265a71ee4dc183561a1857fc"},{"url":"https://git.kernel.org/stable/c/d337213a889705a69735079606d0b4c672b17605"},{"url":"https://git.kernel.org/stable/c/e11d5ae96d5e52cb48fa27c6ad352d766d0322fb"},{"url":"https://git.kernel.org/stable/c/6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9"},{"url":"https://git.kernel.org/stable/c/e3619bed5da125713b29ac881dc66f5e06606f88"},{"url":"https://git.kernel.org/stable/c/e1330d719c047c4d8190a16be034b29fc601a815"},{"url":"https://git.kernel.org/stable/c/8eb73016fb3968cf2db3987a92764563a3af773a"},{"url":"https://git.kernel.org/stable/c/3bbd05723d15dd06f0560bcd94fbf9a91b5f5613"}],"title":"wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89524","datePublished":"2026-09-11T19:44:05.548Z","dateReserved":"2026-09-11T19:38:34.719Z","dateUpdated":"2026-09-14T12:00:40.689Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:35","lastModifiedDate":"2026-09-14 13:19:08","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89524","Ordinal":"1","Title":"wifi: ath6kl: clamp assoc request/response lengths before subtra","CVE":"CVE-2026-89524","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89524","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets\n\nath6kl_cfg80211_connect_event() subtracts fixed IE offsets from\nassoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower\nbound. The aggregate check recently added to ath6kl_wmi_connect_event_rx()\nbounds the declared lengths from above (their sum must fit the received\nevent), but an assoc request/response shorter than its fixed offset still\nunderflows here: the u8 wraps to ~250, and cfg80211_connect_result() /\ncfg80211_roamed() then treat that wrapped value as the IE length and copy\nthat many bytes out of the small assoc_info buffer to user space via\nnl80211, disclosing adjacent slab memory.\n\nClamp both lengths to their offsets before subtracting.\n\nFound by 0sec (https://0sec.ai) using automated source analysis; the\nmissing lower bound is evident from source. Compile-tested.","Type":"Description","Title":"wifi: ath6kl: clamp assoc request/response lengths before subtra"}]}}}