CVE-2026-68196

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: wilc1000: validate assoc response length before subtracting header<br /> <br /> wilc_parse_assoc_resp_info() computes the trailing IE length as<br /> <br /> ies_len = buffer_len - sizeof(*res);<br /> <br /> without first checking that buffer_len is at least sizeof(struct<br /> wilc_assoc_resp) (6 bytes). buffer_len is the length reported for a<br /> received association response (host_int_parse_assoc_resp_info() passes<br /> hif_drv-&gt;assoc_resp / assoc_resp_info_len straight in) and must be<br /> validated before the driver accesses the fixed header.<br /> <br /> For a frame shorter than the 6-byte fixed header, the subtraction wraps.<br /> For a four-byte response the result is truncated to a u16 ies_len of<br /> 65534, so kmemdup() then attempts to copy 65534 bytes starting at<br /> buffer + sizeof(*res), beyond the valid association-response data<br /> (CWE-125). A response shorter than four bytes can also cause an<br /> out-of-bounds read of res-&gt;status_code at offsets 2 and 3.<br /> <br /> Reject frames too short to hold the fixed header before touching the<br /> header or computing ies_len. Also set the connection status to a failure<br /> on this path: the caller falls through to a<br /> "conn_info-&gt;status == WLAN_STATUS_SUCCESS" check after the parser<br /> returns, so leaving the status untouched could let a malformed short<br /> response be treated as a successful association.