What is the CVSS score of CVE-2026-68199?

CVE-2026-68199 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68199?

A high-severity vulnerability in Linux's ath6kl WiFi driver (CVE-2026-68199) allows unauthenticated, WiFi-adjacent attackers to disrupt or potentially compromise Linux systems through malformed…. A patch is available.

How to fix or mitigate CVE-2026-68199?

Within 24 hours: Audit systems running affected Linux kernel versions (prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5) with ath6kl WiFi driver enabled to determine remediation scope. Within 7 days: Plan and stage kernel updates for affected systems, prioritizing production servers and high-availability infrastructure with wireless connectivity. Within 30 days: Deploy kernel updates to all affected systems by upgrading to patched versions (6.6.148+, 6.12.101+, 6.18.42+, 7.1.6+, or 7.2-rc5+) and verify successful deployment through boot verification and kernel version confirmation.

Linux Kernel CVE-2026-68199

EUVD-2026-55300 HIGH

2026-08-10 Linux

GHSA-78gm-4hww-qgr6

Buffer Overflow Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent WiFi vector, no auth or interaction needed, kernel-level OOB enables full confidentiality, integrity, and availability compromise of the vulnerable system.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:36 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

8.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:00 cve.org

HIGH 8.8

CVE Published

Aug 10, 2026 - 12:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB access from firmware ADDBA window size

aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. The out-of-range win_sz is then used in TID_WINDOW_SZ() to compute a kzalloc size and stored in rxtid->hold_q_sz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access.

Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.

AnalysisAI

Out-of-bounds kernel heap access in the Linux kernel's ath6kl WiFi driver allows an adjacent unauthenticated attacker to trigger zero-size or integer-overflowed kernel allocations by transmitting a malformed ADDBA (Block Acknowledgment) WiFi management frame with an out-of-range window size. Affected are Linux kernel versions from the introduction of the vulnerable code in commit bdcd81707973, with patches confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc5). No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.

Technical ContextAI

The ath6kl driver handles Atheros AR6000-family WiFi chipsets (AR6002/AR6003/AR6004) and processes IEEE 802.11 Block Acknowledgment request (ADDBA) frames in the function aggr_recv_addba_req_evt(). The firmware-supplied win_sz field is supposed to be validated against the bounds [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX]. However, upon receiving an out-of-range value, the function logs a debug message but omits an early return, allowing the unchecked win_sz to propagate into TID_WINDOW_SZ() as an allocation size argument for kzalloc() and to be stored in rxtid->hold_q_sz. This produces zero-size or integer-overflowed heap allocations, followed by out-of-bounds kernel memory read or write - a classic missing input-validation / missing early-return defect (analogous to CWE-125/CWE-787) where attacker-controlled data from the adjacent wireless medium reaches an unchecked size calculation. CPE data identifies the affected product as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is upgrading to a patched kernel version: Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 (or later). Patch commits are confirmed at the kernel stable git tree links above. Distribution vendors (Debian, Ubuntu, RHEL, etc.) are expected to ship these fixes in their respective kernel update channels. For systems where an immediate kernel upgrade is not feasible, the most effective compensating control is to unload or blacklist the ath6kl driver: run modprobe -r ath6kl_usb ath6kl_sdio ath6kl, or add blacklist ath6kl_usb and blacklist ath6kl_sdio to /etc/modprobe.d/blacklist.conf - this disables the vulnerable driver and eliminates the attack surface entirely, at the cost of disabling the associated Atheros WiFi hardware. On systems where the ath6kl hardware is not actively used, this is a zero-trade-off mitigation. Additionally, placing the WiFi interface on a trusted, isolated SSID or disabling the interface (ip link set wlan0 down) reduces adjacency-based exposure for systems that cannot be patched immediately.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68199 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68199

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code