CVE-2026-68199: wifi: ath6kl: fix OOB access from firmware ADDBA window size

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB access from firmware ADDBA window size

aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied
win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not
return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to
compute a kzalloc size and stored in rxtid->hold_q_sz, leading to
zero-size or overflowed allocations and subsequent out-of-bounds access.

Clean up any previously active aggregation session for the TID first,
then return early when win_sz is out of the valid range, instead of
proceeding with a broken allocation size.

The Linux kernel CVE team has assigned CVE-2026-68199 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.2 with commit bdcd81707973cf8aa9305337166f8ee842a050d4 and fixed in 6.6.148 with commit d4558c140782180e2c80a7588a4af9f8675adfc4
	Issue introduced in 3.2 with commit bdcd81707973cf8aa9305337166f8ee842a050d4 and fixed in 6.12.101 with commit 5a65fd4722416061698b0a3277222381efbc4882
	Issue introduced in 3.2 with commit bdcd81707973cf8aa9305337166f8ee842a050d4 and fixed in 6.18.42 with commit 58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c
	Issue introduced in 3.2 with commit bdcd81707973cf8aa9305337166f8ee842a050d4 and fixed in 7.1.6 with commit cec0a487cf38ac1f9bca240ffe8a94c5014b72f2
	Issue introduced in 3.2 with commit bdcd81707973cf8aa9305337166f8ee842a050d4 and fixed in 7.2-rc5 with commit 44126b6994eeb28f2103b638e698f40a1244f327

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68199
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/ath/ath6kl/txrx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d4558c140782180e2c80a7588a4af9f8675adfc4
	https://git.kernel.org/stable/c/5a65fd4722416061698b0a3277222381efbc4882
	https://git.kernel.org/stable/c/58c6c8dc2e022e1b4f3dc58725a1ca49ff470f9c
	https://git.kernel.org/stable/c/cec0a487cf38ac1f9bca240ffe8a94c5014b72f2
	https://git.kernel.org/stable/c/44126b6994eeb28f2103b638e698f40a1244f327