Cloudanix VulnDB

CVE-2026-68199

None

CVSS

—

EPSS

0.4%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in certain Linux Wi-Fi drivers lets bad data from the wireless hardware cause memory errors that can crash the system or allow attacks.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

aggr_recv_addba_req_evt() fails to validate the firmware-supplied win_sz against AGGR_WIN_SZ_MIN/MAX, allowing an out-of-range value to reach TID_WINDOW_SZ() for kzalloc sizing and rxtid->hold_q_sz storage, producing zero-length or overflowed allocations that enable subsequent out-of-bounds memory access.

Why it matters to the business

Wireless drivers on affected Linux systems can be driven into memory corruption by malicious or compromised firmware, risking kernel crashes, denial of service, or potential code execution that disrupts Wi-Fi connectivity and device stability.

How an attack unfolds

An attacker controlling or emulating the ath6kl firmware sends an ADDBA request event carrying a win_sz outside the accepted range; the handler logs but continues, computes an invalid allocation size, stores the bad value, and later performs out-of-bounds accesses on the malformed hold queue during aggregation processing.

How to fix it

Apply the upstream kernel patch that adds an early return after cleaning any active TID aggregation session when win_sz is out of range; rebuild and deploy the updated ath6kl driver or full kernel image; monitor vendor firmware and distribution updates for backports.

How to confirm the fix worked

Confirm the patched aggr_recv_addba_req_evt() contains the range check and early return before kzalloc; exercise the ADDBA path with out-of-range win_sz values in a test environment and verify no invalid allocations or crashes occur; review kernel build logs and module signatures for the corrected driver.

Typical attack path

  1. Compromise or emulate ath6kl firmware to generate crafted ADDBA events
  2. Deliver ADDBA request with win_sz < AGGR_WIN_SZ_MIN or > AGGR_WIN_SZ_MAX
  3. Trigger aggr_recv_addba_req_evt() path without early return
  4. Force zero-size or overflowed kzalloc and corrupted rxtid state
  5. Trigger subsequent aggregation operations that dereference out-of-bounds memory

How to detect it

Search kernel logs for ath6kl aggr_recv_addba_req_evt debug messages mentioning out-of-range win_sz followed by allocation failures or oops; inspect dmesg and journalctl for kzalloc size warnings or slab corruption traces involving rxtid structures; correlate with ath6kl firmware load events.

What your security team should do

  • Prioritize kernel and wireless driver updates on systems using ath6kl hardware
  • Restrict untrusted or third-party firmware loading where possible
  • Enable kernel hardening features such as KASAN and page allocator hardening in test fleets
  • Monitor for ath6kl-related oops or slab allocation warnings in system logs

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access. Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.

Affected packages

Ecosystem Package Introduced Fixed