CVE-2026-68199

High

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access. Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Linux

PublishedAug 10, 2026

First seenAug 10, 2026

Weakness typeCWE-20Improper input validation

How to fix

Update

Linux Linuxc8e3ca7954d8233fbc54bd370c1827670f43c538, f480d9910fcfe326db3a6281df80e83af347193e, 67bc9af4f41f2bdba20404fbd753b2a1bd6dd352, d4558c140782180e2c80a7588a4af9f8675adfc4, 5a65fd4722416061698b0a3277222381efbc4882, 58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c, cec0a487cf38ac1f9bca240ffe8a94c5014b72f2, 44126b6994eeb28f2103b638e698f40a1244f327 or later

Affected products

Product	Affected versions	Fixed in
Linux Linux	bdcd81707973cf8aa9305337166f8ee842a050d4 ≤ v < c8e3ca7954d8233fbc54bd370c1827670f43c538, bdcd81707973cf8aa9305337166f8ee842a050d4 ≤ v < f480d9910fcfe326db3a6281df80e83af347193e, bdcd81707973cf8aa9305337166f8ee842a050d4 ≤ v < 67bc9af4f41f2bdba20404fbd753b2a1bd6dd352, bdcd81707973cf8aa9305337166f8ee842a050d4 ≤ v < d4558c140782180e2c80a7588a4af9f8675adfc4, bdcd81707973cf8aa9305337166f8ee842a050d4 ≤ v < 5a65fd4722416061698b0a3277222381efbc4882, bdcd81707973cf8aa9305337166f8ee842a050d4 ≤ v < 58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c, bdcd81707973cf8aa9305337166f8ee842a050d4 ≤ v < cec0a487cf38ac1f9bca240ffe8a94c5014b72f2, bdcd81707973cf8aa9305337166f8ee842a050d4 ≤ v < 44126b6994eeb28f2103b638e698f40a1244f327, 3.2	c8e3ca7954d8233fbc54bd370c1827670f43c538, f480d9910fcfe326db3a6281df80e83af347193e, 67bc9af4f41f2bdba20404fbd753b2a1bd6dd352, d4558c140782180e2c80a7588a4af9f8675adfc4, 5a65fd4722416061698b0a3277222381efbc4882, 58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c, cec0a487cf38ac1f9bca240ffe8a94c5014b72f2, 44126b6994eeb28f2103b638e698f40a1244f327

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.