CVE-2026-68196

This CVE is misframed as a local driver bug. The real story is a remotely exploitable integer underflow in WiFi association processing that triggers a heap buffer overflow and silently allows a forged association to succeed. The vulnerability lives in wilc_parse_assoc_resp_info(), where buffer_len is subtracted from sizeof(struct wilc_assoc_resp) without prior bounds checking. On a four-byte response, this underflows to 65534, causing kmemdup() to attempt copying 65534 bytes from a four-byte buffer — a heap buffer overflow read triggered by a malformed 802.11 association response frame received over the air. An attacker within wireless range can inject a crafted association response that triggers the underflow and out-of-bounds read, making this a remote attack surface, not a local-only issue. What the CVSS 8.3 score obscures: the connection status is never set to failure on this error path, so the caller falls through to a WLAN_STATUS_SUCCESS check. This means a malformed short response not only leaks heap memory — it can be treated as a successful association. That's a trust-violation flaw layered on top of a memory safety flaw. The attacker gets both an information-disclosing read and the ability to establish a foothold in the connection state machine. Before patching, verify whether your HIF layer or firmware validates raw association response length before handing it to the driver — if not, this is unambiguously remote. Assess what sensitive data resides in the heap region reachable by kmemdup() — session keys, credentials, or other state that would elevate impact. Finally, determine how your connection state machine handles a 'success' status on a truncated response — if it proceeds to 4-way handshake or higher-layer protocols, you have a chaining opportunity for more severe attack. The patch fixes the underflow, but the API boundary problem between HIF and driver likely exists elsewhere in the codebase.

Reviewed through automated stages and approved by a human before publication.