CVE-2026-68355: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68355 is a buffer underflow vulnerability (CWE-124) in the Linux kernel's ath11k Wi-Fi driver, specifically in the ath11k_hal_rx_msdu_list_get() function. When the first entry in the msdu_details array has a zero buffer address, the code attempts to access msdu_details[i - 1] with i == 0, resulting in an out-of-bounds memory access. The vulnerability affects Linux kernel versions from 5.6 onward, with fixes backported to stable releases including 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, 6.18.42, and 7.1.6. It was published on August 10, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is insufficient bounds checking in ath11k_hal_rx_msdu_list_get() (CWE-124: Buffer Underwrite). When iterating over the msdu_details array, the code evaluates a condition that references msdu_details[i - 1] without first verifying that i > 0; if the very first entry has a zero buffer address, the index underflows to -1, causing an out-of-bounds read into kernel memory. The fix mirrors the approach already applied in the analogous ath12k_wifi7_hal_rx_msdu_list_get() function: adding an explicit i == 0 guard before the main condition. The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using the SVACE static analysis tool (GitHub Advisory).

Successful exploitation can lead to kernel memory corruption or a denial of service (system crash/hang) on the affected host. Because the flaw resides in a kernel Wi-Fi driver, exploitation could destabilize the entire operating system, impacting availability. Confidentiality and integrity impacts are assessed as none under the current CVSS scoring, though memory corruption primitives in kernel space carry inherent risk of further escalation in chained attack scenarios (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit exists, and there is no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability requires local access and low privileges to trigger, limiting its attack surface. The EPSS score is approximately 0.00175 (very low probability of exploitation in the near term). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Patches have been backported to multiple stable Linux kernel branches. Users should update to the following fixed versions or later: 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, 6.18.42, or 7.1.6 (GitHub Advisory). Distribution-specific updates (e.g., Red Hat, Debian, Ubuntu) should be applied as they become available. As a temporary workaround where patching is not immediately possible, disabling or blacklisting the ath11k kernel module on systems that do not require Qualcomm Wi-Fi hardware support can eliminate the attack surface.