CVE-2026-68199: wifi: ath6kl: fix OOB access from firmware ADDBA window size
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix OOB access from firmware ADDBA window size
aggrrecvaddbareqevt() logs a debug message when the firmware-supplied winsz is outside [AGGRWINSZMIN, AGGRWINSZMAX] but does not return. The out-of-range winsz is then used in TIDWINDOWSZ() to compute a kzalloc size and stored in rxtid->holdqsz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access.
Clean up any previously active aggregation session for the TID first, then return early when winsz is out of the valid range, instead of proceeding with a broken allocation size.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68199?
The severity of CVE-2026-68199 is rated at 51.
How do I fix CVE-2026-68199?
To fix CVE-2026-68199, update the Linux kernel to a version that includes the fix for this vulnerability.
What systems are affected by CVE-2026-68199?
CVE-2026-68199 affects systems running the Linux kernel that utilize ath6kl Wi-Fi drivers.
What type of vulnerability is CVE-2026-68199?
CVE-2026-68199 is an out-of-bounds access vulnerability within the ath6kl driver in the Linux kernel.
What impact does CVE-2026-68199 have on system security?
CVE-2026-68199 could potentially allow an attacker to exploit out-of-bounds memory access, leading to system instability or unauthorized access.