CVE-2026-68196

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: validate assoc response length before subtracting header

wilc_parse_assoc_resp_info() computes the trailing IE length as

ies_len = buffer_len - sizeof(*res);

without first checking that buffer_len is at least sizeof(struct

wilc_assoc_resp) (6 bytes). buffer_len is the length reported for a

received association response (host_int_parse_assoc_resp_info() passes

hif_drv->assoc_resp / assoc_resp_info_len straight in) and must be

validated before the driver accesses the fixed header.

For a frame shorter than the 6-byte fixed header, the subtraction wraps.

For a four-byte response the result is truncated to a u16 ies_len of

65534, so kmemdup() then attempts to copy 65534 bytes starting at

buffer + sizeof(*res), beyond the valid association-response data

(CWE-125). A response shorter than four bytes can also cause an

out-of-bounds read of res->status_code at offsets 2 and 3.

Reject frames too short to h

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References