CVE-2026-89524

The Linux kernel's ath6kl wireless driver (for Qualcomm Atheros AR600x chipsets) fails to clamp association request/response lengths before subtracting fixed IE offsets in ath6kl_cfg80211_connect_event(). When a malicious or rogue access point delivers an association request shorter than 4 bytes or a response shorter than 6 bytes, the u8 length underflows to roughly 250, and cfg80211_connect_result()/cfg80211_roamed() then copy that many bytes out of the small assoc_info buffer to userspace via nl80211, disclosing adjacent kernel slab memory. The CVSS 8.1 score reflects adjacent-network attack requirements with no privileges or user interaction needed, and high impact on both confidentiality and availability. Only systems actually running the ath6kl driver (typically older embedded, IoT, and mobile-style devices with AR6003/AR6004 SDIO/USB Wi-Fi) are exposed; mainstream servers and desktops are unaffected. The flaw was found by automated source analysis (0sec.ai), is not in the CISA KEV catalog, and has no public PoC or known exploitation.

What to do: Apply a kernel update containing the length-clamping fix as soon as your distribution or vendor ships it (or backport the upstream commit). Because exploitation requires the victim to associate with an attacker-influenced access point, restrict legacy ath6kl devices to trusted/enterprise Wi-Fi networks and use 802.1X where feasible. On systems that do not use AR600x Wi-Fi, blacklist or unload the ath6kl module to eliminate the code path entirely.