{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68355","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.385Z","datePublished":"2026-08-10T12:03:32.321Z","dateUpdated":"2026-08-19T16:34:03.197Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:34:03.197Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()\n\nWhen the first entry in msdu_details has a zero buffer address,\nthe code accesses msdu_details[i - 1] with i == 0, causing a\nbuffer underflow.\n\nFix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding\na separate check for i == 0 before the main condition to prevent\nthe out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"versions":[{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"085a5fde5bac29c01059e69399b417e91c0a6c18","status":"affected","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"31ea4b175bc3ab430be15834d9ee8a1ce65bee15","status":"affected","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591","status":"affected","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a","status":"affected","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"904367381a922aa2dc3e8bd2488e6c9180516c7a","status":"affected","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"a154ca3c441a67d36b3a9ea63a4f11b06abe6223","status":"affected","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5","status":"affected","versionType":"git"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"7f11e70629650ff6ea140984e5ce188b775b2683","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","status":"unaffected","versionType":"semver"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/085a5fde5bac29c01059e69399b417e91c0a6c18"},{"url":"https://git.kernel.org/stable/c/31ea4b175bc3ab430be15834d9ee8a1ce65bee15"},{"url":"https://git.kernel.org/stable/c/20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591"},{"url":"https://git.kernel.org/stable/c/69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a"},{"url":"https://git.kernel.org/stable/c/904367381a922aa2dc3e8bd2488e6c9180516c7a"},{"url":"https://git.kernel.org/stable/c/a154ca3c441a67d36b3a9ea63a4f11b06abe6223"},{"url":"https://git.kernel.org/stable/c/725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5"},{"url":"https://git.kernel.org/stable/c/7f11e70629650ff6ea140984e5ce188b775b2683"}],"title":"wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()","x_generator":{"engine":"bippy-1.2.0"}}}}