In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB access from firmware ADDBA window size

aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied
win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not
return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to
compute a kzalloc size and stored in rxtid->hold_q_sz, leading to
zero-size or overflowed allocations and subsequent out-of-bounds access.

Clean up any previously active aggregation session for the TID first,
then return early when win_sz is out of the valid range, instead of
proceeding with a broken allocation size.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
bdcd81707973cf8aa9305337166f8ee842a050d4 affected < d4558c140782180e2c80a7588a4af9f8675adfc4
bdcd81707973cf8aa9305337166f8ee842a050d4 affected < 5a65fd4722416061698b0a3277222381efbc4882
bdcd81707973cf8aa9305337166f8ee842a050d4 affected < 58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c
bdcd81707973cf8aa9305337166f8ee842a050d4 affected < cec0a487cf38ac1f9bca240ffe8a94c5014b72f2
bdcd81707973cf8aa9305337166f8ee842a050d4 affected < 44126b6994eeb28f2103b638e698f40a1244f327
Linux Linux affected
Version Status Constraints
3.2 affected —
0 unaffected < 3.2
6.6.148 unaffected ≤ 6.6.*
6.12.101 unaffected ≤ 6.12.*
6.18.42 unaffected ≤ 6.18.*
7.1.6 unaffected ≤ 7.1.*
7.2-rc5 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/44126b6994eeb28f2103b638e698f40a1244f327 cve-icon
https://git.kernel.org/stable/c/58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c cve-icon
https://git.kernel.org/stable/c/5a65fd4722416061698b0a3277222381efbc4882 cve-icon
https://git.kernel.org/stable/c/cec0a487cf38ac1f9bca240ffe8a94c5014b72f2 cve-icon
https://git.kernel.org/stable/c/d4558c140782180e2c80a7588a4af9f8675adfc4 cve-icon
History

Mon, 10 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access. Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.
Title wifi: ath6kl: fix OOB access from firmware ADDBA window size
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-10T12:00:18.278Z

Reserved: 2026-07-30T09:28:09.374Z

Link: CVE-2026-68199

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T18:30:04Z

Weaknesses