Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-89524

wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

CVSS 8.1 HighEPSS 0.0027 · 20th percentile

Published by the CVE Program (CNA: Linux) at 11 Sept 2026, 19:44 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 225587bdbf4b0eb5265a71ee4dc183561a1857fc git
  • affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before d337213a889705a69735079606d0b4c672b17605 git
  • affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before e11d5ae96d5e52cb48fa27c6ad352d766d0322fb git
  • affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 6deb4d7a0c3d91821b2a8d5239e3d9933d9217d9 git
  • affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before e3619bed5da125713b29ac881dc66f5e06606f88 git
  • affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before e1330d719c047c4d8190a16be034b29fc601a815 git
  • affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 8eb73016fb3968cf2db3987a92764563a3af773a git
  • affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 3bbd05723d15dd06f0560bcd94fbf9a91b5f5613 git
Other versions: unaffected
Linux Linux
  • affected 3.2
  • unaffected before 3.2 semver
  • unaffected 5.10.270 to 5.10.*, inclusive semver
  • unaffected 5.15.221 to 5.15.*, inclusive semver
  • unaffected 6.1.188 to 6.1.*, inclusive semver
  • unaffected 6.6.157 to 6.6.*, inclusive semver
  • unaffected 6.12.109 to 6.12.*, inclusive semver
  • unaffected 6.18.50 to 6.18.*, inclusive semver
  • unaffected 7.2.4 to 7.2.*, inclusive semver
  • unaffected 7.3 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-89524
CNA
Linux
Tags
Published
11 Sept 2026
Updated
19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
8.1 High 3.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0027, the 20th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 11 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.