CVE-2026-68196

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the wilc1000 wifi driver where the wilc parse assoc resp info() function fails to validate the length of a received association response before subtracting the header size. When a frame is shorter than the 6-byte fixed header, the subtraction of sizeof(*res) from buffer len causes an integer wrap. For instance, a four-byte response results in a truncated ies len of 65534, leading the kmemdup() function to perform an out-of-bounds read by attempting to copy 65534 bytes beyond the valid data. Additionally, responses shorter than four bytes can cause an out-of-bounds read of the status code variable. If the connection status is not explicitly set to failure during this process, a malformed short response might be incorrectly treated as a successful association.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.