CVE-2026-68199: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68199 Overview

CVE-2026-68199 is a Linux kernel vulnerability in the ath6kl Wi-Fi driver that allows out-of-bounds memory access triggered by a malformed firmware ADDBA (Add Block Acknowledgement) request. The function aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz falls outside the [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] range but fails to return. The invalid win_sz then propagates into TID_WINDOW_SZ() and drives a kzalloc size calculation, producing zero-size or overflowed allocations that lead to subsequent out-of-bounds access.

Critical Impact
An attacker on an adjacent Wi-Fi network can trigger memory corruption in the kernel, potentially resulting in code execution, privilege escalation, or denial of service.

Affected Products

Linux kernel builds including the ath6kl Atheros Wi-Fi driver
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Embedded and IoT devices using ath6kl-based wireless chipsets

Discovery Timeline

2026-08-10 - CVE-2026-68199 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68199

Vulnerability Analysis

The defect lives in the aggregation setup path of the ath6kl wireless driver. When the firmware issues an ADDBA request event, aggr_recv_addba_req_evt() extracts the requested receive window size (win_sz) from the event payload. The function emits a debug message when win_sz sits outside the valid range but continues execution rather than aborting. Subsequent code uses this untrusted value in TID_WINDOW_SZ() to derive the allocation size for a hold queue, storing the computed value in rxtid->hold_q_sz.

An attacker-controlled or corrupted win_sz value yields either a zero-size allocation or an arithmetic overflow. Either outcome produces a buffer whose real capacity does not match the size assumed by later code paths, allowing out-of-bounds writes and reads against the kernel heap during aggregation buffer management.

Root Cause

The root cause is missing input validation combined with a control-flow bug: the range check emits a warning but does not return. The invalid win_sz therefore feeds an unchecked allocation size calculation, classifying the flaw as an [Out-of-Bounds Write] and [Improper Input Validation] issue. The upstream fix cleans up any previously active aggregation session for the traffic identifier (TID), then returns early when win_sz is outside the accepted bounds.

Attack Vector

Exploitation requires adjacency to the target network, consistent with the AV:A attack vector. A malicious or compromised Wi-Fi access point, or a peer capable of injecting management frames that cause the firmware to generate a crafted ADDBA event, can influence the win_sz value reaching the kernel driver. Because the vulnerable code executes in kernel context during normal 802.11 aggregation negotiation, no user interaction is required.

See the upstream fixes for the exact patch content: Kernel commit 44126b6994ee and Kernel commit 5a65fd472241.

Detection Methods for CVE-2026-68199

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing aggr_recv_addba_req_evt, TID_WINDOW_SZ, or rxtid->hold_q_sz on hosts using the ath6kl driver.
Unexpected wireless interface resets or driver reload events correlated with association to untrusted access points.
Debug log entries indicating firmware-supplied ADDBA win_sz values outside the valid [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] range.

Detection Strategies

Monitor dmesg and journald output for ath6kl driver warnings and kernel memory-corruption reports (KASAN, slab-out-of-bounds).
Track kernel version inventory across Linux endpoints and IoT devices to identify hosts running unpatched ath6kl builds.
Correlate wireless association events with subsequent kernel instability to surface adjacent-network exploitation attempts.

Monitoring Recommendations

Forward kernel logs from Linux endpoints, embedded systems, and IoT gateways to a centralized log platform for anomaly detection.
Alert on repeated Wi-Fi driver crashes or ath6kl module reloads on the same host within short time windows.
Baseline wireless behavior for fleet devices and flag anomalous ADDBA negotiation patterns captured via wireless IDS sensors.

How to Mitigate CVE-2026-68199

Immediate Actions Required

Apply the upstream Linux stable kernel updates that include the ath6kl win_sz validation fix as soon as vendor packages are available.
Identify all systems running the ath6kl driver and prioritize patching for devices operating in untrusted wireless environments.
Restrict affected devices from associating with unknown or public Wi-Fi networks until the patch is deployed.

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Relevant commits include 44126b6994ee, 58c6c8dc2e02, 5a65fd472241, cec0a487cf38, and d4558c140782. The patch cleans up any previously active aggregation session for the TID and returns early when win_sz is out of range, preventing the invalid value from reaching the allocation path.

Workarounds

Unload the ath6kl kernel modules (ath6kl_core, ath6kl_sdio, ath6kl_usb) on systems that do not require them and blacklist them via /etc/modprobe.d/.
Disable wireless connectivity on affected devices or constrain them to trusted, controlled access points until patches are applied.
Apply enterprise policy to prevent affected Linux hosts from joining public or untrusted Wi-Fi networks.

bash

# Blacklist the ath6kl driver where not required
echo "blacklist ath6kl_core" | sudo tee /etc/modprobe.d/blacklist-ath6kl.conf
echo "blacklist ath6kl_sdio" | sudo tee -a /etc/modprobe.d/blacklist-ath6kl.conf
echo "blacklist ath6kl_usb"  | sudo tee -a /etc/modprobe.d/blacklist-ath6kl.conf
sudo update-initramfs -u
sudo reboot