CVE-2026-68196

What the bug is

wilc_parse_assoc_resp_info() computes the trailing IE length as ies_len = buffer_len - sizeof(*res); without first checking that buffer_len is at least sizeof(struct wilc_assoc_resp) (6 bytes). buffer_len is the length reported for a received association response (host_int_parse_assoc_resp_info() passes hif_drv->assoc_resp / assoc_resp_info_len straight in) and must be validated before the driver accesses the fixed header. For a frame shorter than the 6-byte fixed header, the subtraction wraps. For a four-byte response the result is truncated to a u16 ies_len of 65534, so kmemdup() then attempts to copy 65534 bytes starting at buffer + sizeof(*res), beyond the valid association-response data (CWE-125). A response shorter than four bytes can also cause an out-of-bounds read of res->status_code at offsets 2 and 3. Reject frames too short to hold the fixed header before touching the header or computing ies_len. Also set the connection status to a failure on this path: the caller falls through to a "conn_info->status == WLAN_STATUS_SUCCESS" check after the parser returns, so leaving the status untouched could let a malformed short response be treated as a successful association.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/net/wireless/microchip/wilc1000/hif.c

What this is

MICROCHIP WILC1000 WIFI DRIVERMAINTAINERS section matched on drivers/net/wireless/microchip/ · linux-wireless@vger.kernel.org · Supported

Kernel module

none to look for. The file would have gone into wilc1000, and Debian does not compile it into that module, so finding wilc1000 in lsmod would say nothing about this CVE.

Check it on the machine

grep -wE 'CONFIG_WILC1000|CONFIG_WLAN|CONFIG_WLAN_VENDOR_MICROCHIP' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.

• bookworm, trixie, forky, sid, bookworm · linux-6.12n

n

not enabled on any flavour - this release does not build the code

Build switches

CONFIG_WILC1000, CONFIG_WLAN, CONFIG_WLAN_VENDOR_MICROCHIP

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-08-10 (2 months ago)source

CVSS

8.3 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Hsource recompute it

Attack vector

adjacent network (AV:A)source

EPSS

0.41%, higher than 34.1% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/net

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.2	5.10.265	d79b92417f33
4.2	5.15.216	b81d0ea9e1da
4.2	6.1.183	8d50acf5420d
4.2	6.6.148	584c8954ad55
4.2	6.12.101	4d410320e8ae
4.2	6.18.42	e511e93abd6e
4.2	7.1.6	8ccdf8c8de87
4.2	7.2	4c4c97b60a5e

Debian advisories