CVE-2026-68199
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In the Linux kernel, in the wifi ath6kl driver, there is an out-of-bounds (OOB) access issue caused by the firmware-supplied ADDBA window size. The aggr_recv_addba_req_evt() function logs a debug message when win_sz is out of range but does not return. The out-of-range win_sz is then used to compute an allocation size, leading to zero-size or overflowed allocations and subsequent out-of-bounds access.
Risk Assessment
This can lead to system crashes or potential execution of malicious code by an attacker who can control firmware or send malicious packets.
Recommendation
Apply the Linux kernel patch that cleans up any previously active aggregation session for the TID and returns early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access. Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.