CVE-2026-68355: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-hxmx-3v2p-jphh
Share
Published
Advisory Summary

CVE-2026-68355 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-68355 at a Glance

CVE Identifier CVE-2026-68355
GHSA Identifier GHSA-hxmx-3v2p-jphh
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-68355

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-68355, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer underflow. Fix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding a separate check for i == 0 before the main condition to prevent the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.

References

NVD — CVE-2026-68355 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68355
git.kernel.org/stable/c/085a5fde5b... WEB
https://git.kernel.org/stable/c/085a5fde5bac29c01059e69399b417e91c0a6c18
git.kernel.org/stable/c/20d18a5ec6... WEB
https://git.kernel.org/stable/c/20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591
git.kernel.org/stable/c/31ea4b175b... WEB
https://git.kernel.org/stable/c/31ea4b175bc3ab430be15834d9ee8a1ce65bee15
git.kernel.org/stable/c/69a6a4f60b... WEB
https://git.kernel.org/stable/c/69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a
git.kernel.org/stable/c/725c1c3a8c... WEB
https://git.kernel.org/stable/c/725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5
git.kernel.org/stable/c/7f11e70629... WEB
https://git.kernel.org/stable/c/7f11e70629650ff6ea140984e5ce188b775b2683
git.kernel.org/stable/c/904367381a... WEB
https://git.kernel.org/stable/c/904367381a922aa2dc3e8bd2488e6c9180516c7a
git.kernel.org/stable/c/a154ca3c44... WEB
https://git.kernel.org/stable/c/a154ca3c441a67d36b3a9ea63a4f11b06abe6223

Frequently Asked Questions

What is CVE-2026-68355?
CVE-2026-68355 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-68355?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-68355?
CVE-2026-68355 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-68355?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hxmx-3v2p-jphh",
  "modified" : "2026-08-19T18:32:16Z",
  "published" : "2026-08-10T15:33:48Z",
  "aliases" : [ "CVE-2026-68355" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()\n\nWhen the first entry in msdu_details has a zero buffer address,\nthe code accesses msdu_details[i - 1] with i == 0, causing a\nbuffer underflow.\n\nFix similarly to ath12k_wifi7_hal_rx_msdu_list_get() by adding\na separate check for i == 0 before the main condition to prevent\nthe out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68355"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/085a5fde5bac29c01059e69399b417e91c0a6c18"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/20d18a5ec6ec364fcaf0d03af6fc43dcc42c6591"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/31ea4b175bc3ab430be15834d9ee8a1ce65bee15"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/69a6a4f60b2da92c0bdfd9264b8ffe053f51f52a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/725c1c3a8c5d920a7d3f5887412f2ad8e95a74f5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7f11e70629650ff6ea140984e5ce188b775b2683"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/904367381a922aa2dc3e8bd2488e6c9180516c7a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a154ca3c441a67d36b3a9ea63a4f11b06abe6223"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-10T13:20:27Z"
  }
}