HIGH Introduced in 3.2
ath6kl AddBaReq OOB
CVE-2026-68199
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access. Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.
02KernelScan AI Analysis
Risk summary
A device using the ath6kl WiFi driver can be attacked by a nearby unauthenticated attacker sending crafted WiFi frames. The firmware may report an out-of-range aggregation window size that the driver fails to reject, leading to a zero-size or overflowed heap allocation and subsequent out-of-bounds memory access. This can result in kernel memory corruption, information disclosure, or a system crash.
Vulnerability analysis
The ath6kl WiFi driver accepts a window-size value from the firmware during receive aggregation setup. If the firmware supplies a value outside the allowed range, the driver logs a warning but still uses it to calculate how much memory to allocate. That calculation can wrap around or request zero bytes, producing a buffer that is too small. The driver then accesses memory beyond that buffer during normal packet reception. The corrected code now discards the invalid value and aborts the setup after cleaning up any earlier aggregation state, instead of continuing with the bad allocation. A nearby attacker can trigger this by sending WiFi frames that cause the firmware to pass a malformed window size to the driver; no authentication, special privileges, or user action are needed.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.2 | 5.10.265 | c8e3ca7954d8 |
| 5.15 | 3.2 | 5.15.216 | f480d9910fcf |
| 6.1 | 3.2 | 6.1.183 | 67bc9af4f41f |
| 6.12 | 3.2 | 6.12.101 | 5a65fd472241 |
| 6.18 | 3.2 | 6.18.42 | 58c6c8dc2e02 |
| 6.6 | 3.2 | 6.6.148 | d4558c140782 |
| 7.1 | 3.2 | 7.1.6 | cec0a487cf38 |
| mainline | 3.2 | 7.2 | 44126b6994ee |
| cip/4.19 | 3.2 | 4.19.325-cip136 | 5163671fdc09 |
| cip/4.19-rt | 3.2 | 4.19.325-cip136-rt50 | 5163671fdc09 |
| cip/4.4 | 3.2 | 4.4.302-cip115 | 06919fd70e4c |
| cip/4.4-rt | 3.2 | 4.4.302-cip115-rt63 | 06919fd70e4c |
| cip/5.10 | 3.2 | 5.10.268-cip77 | c8e3ca7954d8 |
| cip/5.10-rt | 3.2 | 5.10.268-cip77-rt34 | c8e3ca7954d8 |
| cip/6.1 | 3.2 | 6.1.187-cip60 | 67bc9af4f41f |
| cip/6.1-rt | 3.2 | 6.1.189-cip61-rt32 | 67bc9af4f41f |
| cip/6.12 | 3.2 | 6.12.101-cip29 | 5a65fd472241 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |
| cip/4.4 | Fixed in 4.4.302-cip115 |
| cip/4.4-rt | Fixed in 4.4.302-cip115-rt63 |