The ath6kl driver in the Linux kernel processes a window size supplied by firmware during an ADDBA request. When the firmware returns a value outside the valid range [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX], the driver logs a debug message but continues to use the value to compute a buffer allocation. This can result in a zero‑size or overflowed allocation, causing out-of-bounds memory access that corrupts kernel memory. The corruption can lead to system crashes or other instability.

Linux systems that load the ath6kl wireless driver are affected. The vulnerability is present in kernels that have not yet incorporated the fix committed in 44126b6. Specific kernel or distribution versions are not enumerated in the payload, but systems running older mainline kernels before the commit are at risk.

The CVSS score of 8.8 indicates high severity. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker sending a malformed ADDBA request via a wireless client, but this inference is based on the nature of the ADDBA handling and is not directly stated in the payload.