{"id":"CVE-2026-68355","state":"PUBLISHED","title":"wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()\n\nWhen the first entry in msdu_details has a zero buffer address,\nthe code accesses msdu_details[i - 1] with i == 0, causing a\nbuffer underflow.\n\nFix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding\na separate check for i == 0 before the main condition to prevent\nthe out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.","publishedAt":"2026-08-10T12:03:32.321Z","updatedAt":"2026-08-19T16:34:03.197Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"085a5fde5bac29c01059e69399b417e91c0a6c18","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"31ea4b175bc3ab430be15834d9ee8a1ce65bee15","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"904367381a922aa2dc3e8bd2488e6c9180516c7a","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"a154ca3c441a67d36b3a9ea63a4f11b06abe6223","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"7f11e70629650ff6ea140984e5ce188b775b2683","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.6","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"]}],"references":["https://git.kernel.org/stable/c/085a5fde5bac29c01059e69399b417e91c0a6c18","https://git.kernel.org/stable/c/31ea4b175bc3ab430be15834d9ee8a1ce65bee15","https://git.kernel.org/stable/c/20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591","https://git.kernel.org/stable/c/69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a","https://git.kernel.org/stable/c/904367381a922aa2dc3e8bd2488e6c9180516c7a","https://git.kernel.org/stable/c/a154ca3c441a67d36b3a9ea63a4f11b06abe6223","https://git.kernel.org/stable/c/725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5","https://git.kernel.org/stable/c/7f11e70629650ff6ea140984e5ce188b775b2683"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68355.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68355","state":"PUBLISHED","datePublished":"2026-08-10T12:03:32.321Z","dateUpdated":"2026-08-19T16:34:03.197Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.385Z"},"containers":{"cna":{"title":"wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()\n\nWhen the first entry in msdu_details has a zero buffer address,\nthe code accesses msdu_details[i - 1] with i == 0, causing a\nbuffer underflow.\n\nFix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding\na separate check for i == 0 before the main condition to prevent\nthe out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"085a5fde5bac29c01059e69399b417e91c0a6c18","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"31ea4b175bc3ab430be15834d9ee8a1ce65bee15","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"904367381a922aa2dc3e8bd2488e6c9180516c7a","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"a154ca3c441a67d36b3a9ea63a4f11b06abe6223","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","status":"affected","lessThan":"7f11e70629650ff6ea140984e5ce188b775b2683","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.6","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/085a5fde5bac29c01059e69399b417e91c0a6c18"},{"url":"https://git.kernel.org/stable/c/31ea4b175bc3ab430be15834d9ee8a1ce65bee15"},{"url":"https://git.kernel.org/stable/c/20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591"},{"url":"https://git.kernel.org/stable/c/69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a"},{"url":"https://git.kernel.org/stable/c/904367381a922aa2dc3e8bd2488e6c9180516c7a"},{"url":"https://git.kernel.org/stable/c/a154ca3c441a67d36b3a9ea63a4f11b06abe6223"},{"url":"https://git.kernel.org/stable/c/725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5"},{"url":"https://git.kernel.org/stable/c/7f11e70629650ff6ea140984e5ce188b775b2683"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-19T16:34:03.197Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}