The Linux kernel's ath6kl_cfg80211_connect_event() function subtracts fixed IE offsets from assoc_req_len and assoc_resp_len, both unsigned 8-bit integers, without verifying a lower bound. If the association request or response is shorter than the fixed offset, the subtraction underflows, wrapping the length to a large value (~250). This wrapped value is then used as the IE length in cfg80211_connect_result() or cfg80211_roamed(), causing excessive copying of data from a small assoc_info buffer to user space via nl80211. This results in disclosure of adjacent slab memory. The vulnerability was found by 0sec using automated source analysis. The fix clamps the lengths to their offsets before subtracting to prevent underflow.

The vulnerability can lead to disclosure of adjacent kernel memory to user space, potentially exposing sensitive information. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented that clamps association request and response lengths before subtracting IE offsets, preventing underflow. Users should apply the official Linux kernel update that includes this fix. Since this is a kernel vulnerability, updating to the patched kernel version is the recommended mitigation.