CVE-2026-68199

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB access from firmware ADDBA window size

aggrrecvaddbareqevt() logs a debug message when the firmware-supplied winsz is outside [AGGRWINSZMIN, AGGRWINSZMAX] but does not return. The out-of-range winsz is then used in TIDWINDOWSZ() to compute a kzalloc size and stored in rxtid->holdqsz, leading to zero-size or overflowed allocations and subsequent out-of-bounds access.

Clean up any previously active aggregation session for the TID first, then return early when win_sz is out of the valid range, instead of proceeding with a broken allocation size.