CVE-2026-68352

The vulnerability in CVE-2026-68352 stems from `ath6kl_wmi_connect_event_rx()` treating three length fields from firmware as inherently trustworthy. These fields — ingested directly from the WMI event buffer without cross-referencing against the actual buffer size — drive offset calculations and information element parsing. The total derived length can reach 765 bytes, creating an out-of-bounds read when the actual buffer is smaller. This is not a simple coding oversight. It reflects a legacy trust model where firmware and host driver were treated as a unified, trusted system. In 2026, with documented firmware-level implants and proliferating firmware vulnerabilities, this assumption is indefensible. The kernel's WMI interface itself bears blame: it delivers raw, length-prefixed blobs to callback handlers without providing validation primitives, making trust the path of least resistance. The secondary effect on `wmi->is_wmm_enabled` is analytically significant. A corrupted WMM state flag can alter downstream driver operations — scheduling, power management, peer association logic — creating conditions for behavioral manipulation rather than mere information disclosure. Whether this enables exploits beyond what the primary OOB read already provides is an open question, but the corruption reveals a driver philosophy of failing opaque rather than failing safe. The EPSS score of 0.00209 is misleading. It reflects device prevalence and attacker interest, not actual exploitability. ath6kl hardware may be niche, but it persists in embedded and industrial deployments far beyond commercial relevance. The patch propagation problem is severe: many devices run out-of-tree vendor drivers, meaning the upstream fix may reach only a fraction of affected deployments. Audit the other WMI event handlers in ath6kl for similar patterns — the fix may be narrowly scoped to the discovered code path. More broadly, treat this as evidence that firmware boundary validation must become a first-class kernel primitive rather than optional hardening.

Reviewed through automated stages and approved by a human before publication.