CVE-2026-89524

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

ath6kl cfg80211 connect event() subtracts fixed IE offsets from assoc req len (-= 4) and assoc resp len (-= 6), both u8, with no lower bound. The aggregate check recently added to ath6kl wmi connect event rx() bounds the declared lengths from above (their sum must fit the received event), but an assoc request/response shorter than its fixed offset still underflows here: the u8 wraps to ~250, and cfg80211 connect result() / cfg80211 roamed() then treat that wrapped value as the IE length and copy that many bytes out of the small assoc info buffer to user space via nl80211, disclosing adjacent slab memory.

Clamp both lengths to their offsets before subtracting.

Found by 0sec (https://0sec.ai) using automated source analysis; the missing lower bound is evident from source. Compile-tested.