CVE-2026-68355

Source
https://cve.org/CVERecord?id=CVE-2026-68355
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68355.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68355
Downstream
Published
2026-08-10T12:03:32.321Z
Modified
2026-08-12T04:18:48.146289619Z
Summary
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix potential buffer underflow in ath11khalrxmsdulist_get()

When the first entry in msdudetails has a zero buffer address, the code accesses msdudetails[i - 1] with i == 0, causing a buffer underflow.

Fix similarly to ath12kwifi7halrxmsdulistget() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68355.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d5c65159f2895379e11ca13f62feabe93278985d
Fixed
69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a
Fixed
904367381a922aa2dc3e8bd2488e6c9180516c7a
Fixed
a154ca3c441a67d36b3a9ea63a4f11b06abe6223
Fixed
725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5
Fixed
7f11e70629650ff6ea140984e5ce188b775b2683

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68355.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.6.0
Fixed
6.6.148
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.101
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.42
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.6

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68355.json"