GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68199 (GCVE-0-2026-68199)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:00 – Updated: 2026-08-19 16:31
VLAI
Title
wifi: ath6kl: fix OOB access from firmware ADDBA window size
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access. Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < c8e3ca7954d8233fbc54bd370c1827670f43c538 (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < f480d9910fcfe326db3a6281df80e83af347193e (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 67bc9af4f41f2bdba20404fbd753b2a1bd6dd352 (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < d4558c140782180e2c80a7588a4af9f8675adfc4 (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 5a65fd4722416061698b0a3277222381efbc4882 (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < cec0a487cf38ac1f9bca240ffe8a94c5014b72f2 (git)
Affected: bdcd81707973cf8aa9305337166f8ee842a050d4 , < 44126b6994eeb28f2103b638e698f40a1244f327 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath6kl/txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c8e3ca7954d8233fbc54bd370c1827670f43c538",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "f480d9910fcfe326db3a6281df80e83af347193e",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "67bc9af4f41f2bdba20404fbd753b2a1bd6dd352",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "d4558c140782180e2c80a7588a4af9f8675adfc4",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "5a65fd4722416061698b0a3277222381efbc4882",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "cec0a487cf38ac1f9bca240ffe8a94c5014b72f2",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "44126b6994eeb28f2103b638e698f40a1244f327",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath6kl/txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix OOB access from firmware ADDBA window size\n\naggr_recv_addba_req_evt() logs a debug message when the firmware-supplied\nwin_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not\nreturn. The out-of-range win_sz is then used in TID_WINDOW_SZ() to\ncompute a kzalloc size and stored in rxtid-\u003ehold_q_sz, leading to\nzero-size or overflowed allocations and subsequent out-of-bounds access.\n\nClean up any previously active aggregation session for the TID first,\nthen return early when win_sz is out of the valid range, instead of\nproceeding with a broken allocation size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Exploitation requires a malicious WiFi peer (rogue AP or associated client) to trigger ADDBA handling; firmware passes WMI_ADDBA_REQ_EVENTID over the radio link to the ath6kl driver, placing the attacker on the same wireless segment rather than a remote IP network path.\nAC:L - An adjacent attacker can reliably send crafted 802.11 ADDBA requests with out-of-range buffer/window sizes to firmware, which forwards the invalid win_sz to the host; no special memory layout, race, or rare timing is required beyond normal WiFi association.\nPR:N - No local Linux privileges are needed; any associated WiFi peer can induce the malformed ADDBA event. The bug is not reachable via user namespaces or unprivileged local syscalls without controlling the WiFi link/firmware messages.\nUI:N - Once the victim device is associated to WiFi (common on phones, embedded, and IoT), the attacker can send ADDBA and follow-up data frames without any additional victim action beyond routine wireless connectivity.\nS:U - Heap corruption and kernel privilege escalation occur within the same kernel security domain; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Out-of-bounds access to hold_q allows reading/writing adjacent kernel heap memory (e.g., skb pointers and metadata); OOB kernel heap access is treated as arbitrary memory disclosure potential per kernel CVSS guidance.\nI:H - OOB writes to hold_q entries (struct sk_buff pointers, is_amsdu, seq_no) corrupt kernel heap state and can be leveraged for control-flow hijacking and local privilege escalation, not merely a bounded modification.\nA:H - Invalid win_sz can yield zero-size allocations and hold_q_sz=0 (divide-by-zero in AGGR_WIN_IDX) or inconsistent buffers, causing kernel oops/panic or persistent disruption when aggregation receives subsequent frames."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:31:18.842Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c8e3ca7954d8233fbc54bd370c1827670f43c538"
        },
        {
          "url": "https://git.kernel.org/stable/c/f480d9910fcfe326db3a6281df80e83af347193e"
        },
        {
          "url": "https://git.kernel.org/stable/c/67bc9af4f41f2bdba20404fbd753b2a1bd6dd352"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4558c140782180e2c80a7588a4af9f8675adfc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a65fd4722416061698b0a3277222381efbc4882"
        },
        {
          "url": "https://git.kernel.org/stable/c/58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/cec0a487cf38ac1f9bca240ffe8a94c5014b72f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/44126b6994eeb28f2103b638e698f40a1244f327"
        }
      ],
      "title": "wifi: ath6kl: fix OOB access from firmware ADDBA window size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68199",
    "datePublished": "2026-08-10T12:00:18.278Z",
    "dateReserved": "2026-07-30T09:28:09.374Z",
    "dateUpdated": "2026-08-19T16:31:18.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68199",
      "date": "2026-09-16",
      "epss": "0.00412",
      "percentile": "0.34939"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68199\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:07.397\",\"lastModified\":\"2026-08-19T17:20:36.100\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath6kl: fix OOB access from firmware ADDBA window size\\n\\naggr_recv_addba_req_evt() logs a debug message when the firmware-supplied\\nwin_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not\\nreturn. The out-of-range win_sz is then used in TID_WINDOW_SZ() to\\ncompute a kzalloc size and stored in rxtid-\u003ehold_q_sz, leading to\\nzero-size or overflowed allocations and subsequent out-of-bounds access.\\n\\nClean up any previously active aggregation session for the TID first,\\nthen return early when win_sz is out of the valid range, instead of\\nproceeding with a broken allocation size.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath6kl/txrx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"c8e3ca7954d8233fbc54bd370c1827670f43c538\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"f480d9910fcfe326db3a6281df80e83af347193e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"67bc9af4f41f2bdba20404fbd753b2a1bd6dd352\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"d4558c140782180e2c80a7588a4af9f8675adfc4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"5a65fd4722416061698b0a3277222381efbc4882\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"cec0a487cf38ac1f9bca240ffe8a94c5014b72f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bdcd81707973cf8aa9305337166f8ee842a050d4\",\"lessThan\":\"44126b6994eeb28f2103b638e698f40a1244f327\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath6kl/txrx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/44126b6994eeb28f2103b638e698f40a1244f327\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5a65fd4722416061698b0a3277222381efbc4882\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/67bc9af4f41f2bdba20404fbd753b2a1bd6dd352\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c8e3ca7954d8233fbc54bd370c1827670f43c538\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cec0a487cf38ac1f9bca240ffe8a94c5014b72f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d4558c140782180e2c80a7588a4af9f8675adfc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f480d9910fcfe326db3a6281df80e83af347193e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-11T08:51:29+00:00",
      "cve": "CVE-2026-68199",
      "id": "CVE-2026-68199",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath6kl: fix OOB access from firmware ADDBA window size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68199.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T17:11:01Z",
      "cve": "CVE-2026-68199",
      "id": "CVE-2026-68199",
      "initial_release_date": "2026-08-13T16:23:13Z",
      "product_status:first_fixed": "65",
      "product_status:known_affected": "671",
      "product_status:known_not_affected": "76",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68199",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68199.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.