CVE-2026-68196: wifi: wilc1000: validate assoc response length before subtracting header

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: validate assoc response length before subtracting header

wilc_parse_assoc_resp_info() computes the trailing IE length as

	ies_len = buffer_len - sizeof(*res);

without first checking that buffer_len is at least sizeof(struct
wilc_assoc_resp) (6 bytes). buffer_len is the length reported for a
received association response (host_int_parse_assoc_resp_info() passes
hif_drv->assoc_resp / assoc_resp_info_len straight in) and must be
validated before the driver accesses the fixed header.

For a frame shorter than the 6-byte fixed header, the subtraction wraps.
For a four-byte response the result is truncated to a u16 ies_len of
65534, so kmemdup() then attempts to copy 65534 bytes starting at
buffer + sizeof(*res), beyond the valid association-response data
(CWE-125). A response shorter than four bytes can also cause an
out-of-bounds read of res->status_code at offsets 2 and 3.

Reject frames too short to hold the fixed header before touching the
header or computing ies_len. Also set the connection status to a failure
on this path: the caller falls through to a
"conn_info->status == WLAN_STATUS_SUCCESS" check after the parser
returns, so leaving the status untouched could let a malformed short
response be treated as a successful association.

The Linux kernel CVE team has assigned CVE-2026-68196 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.2 with commit c5c77ba18ea66aa05441c71e38473efb787705a4 and fixed in 6.6.148 with commit 584c8954ad55f8b09b475be6db710fe40ceb988c
	Issue introduced in 4.2 with commit c5c77ba18ea66aa05441c71e38473efb787705a4 and fixed in 6.12.101 with commit 4d410320e8ae5933e651660c9fadc1d380309e23
	Issue introduced in 4.2 with commit c5c77ba18ea66aa05441c71e38473efb787705a4 and fixed in 6.18.42 with commit e511e93abd6eeedcd5b3c55516241f414fbde64a
	Issue introduced in 4.2 with commit c5c77ba18ea66aa05441c71e38473efb787705a4 and fixed in 7.1.6 with commit 8ccdf8c8de87a9580df37c3c1ec53ba88cedef65
	Issue introduced in 4.2 with commit c5c77ba18ea66aa05441c71e38473efb787705a4 and fixed in 7.2-rc5 with commit 4c4c97b60a5e978121d9ee8cb0ab3916e5d6a8de

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68196
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/microchip/wilc1000/hif.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/584c8954ad55f8b09b475be6db710fe40ceb988c
	https://git.kernel.org/stable/c/4d410320e8ae5933e651660c9fadc1d380309e23
	https://git.kernel.org/stable/c/e511e93abd6eeedcd5b3c55516241f414fbde64a
	https://git.kernel.org/stable/c/8ccdf8c8de87a9580df37c3c1ec53ba88cedef65
	https://git.kernel.org/stable/c/4c4c97b60a5e978121d9ee8cb0ab3916e5d6a8de