CVE-2026-68199

wifi: ath6kl: fix OOB access from firmware ADDBA window size

State: Published
Severity: 8.8 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB access from firmware ADDBA window size

aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access.

Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	bdcd81707973cf8aa9305337166f8ee842a050d4 to before c8e3ca7954d8233fbc54bd370c1827670f43c538Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before f480d9910fcfe326db3a6281df80e83af347193eAffected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 67bc9af4f41f2bdba20404fbd753b2a1bd6dd352Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before d4558c140782180e2c80a7588a4af9f8675adfc4Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 5a65fd4722416061698b0a3277222381efbc4882Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9cAffected bdcd81707973cf8aa9305337166f8ee842a050d4 to before cec0a487cf38ac1f9bca240ffe8a94c5014b72f2Affected bdcd81707973cf8aa9305337166f8ee842a050d4 to before 44126b6994eeb28f2103b638e698f40a1244f327Affected
LinuxLinux	3.2Affected before 3.2Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

bdcd81707973cf8aa9305337166f8ee842a050d4 to before c8e3ca7954d8233fbc54bd370c1827670f43c538Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before f480d9910fcfe326db3a6281df80e83af347193eAffected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 67bc9af4f41f2bdba20404fbd753b2a1bd6dd352Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before d4558c140782180e2c80a7588a4af9f8675adfc4Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 5a65fd4722416061698b0a3277222381efbc4882Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9cAffected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before cec0a487cf38ac1f9bca240ffe8a94c5014b72f2Affected
bdcd81707973cf8aa9305337166f8ee842a050d4 to before 44126b6994eeb28f2103b638e698f40a1244f327Affected

LinuxLinux

3.2Affected
before 3.2Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.