CVE-2026-68198 - Vulnerability Details

- wifi: ath6kl: fix use-after-free in aggr_reset_state()

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix use-after-free in aggr_reset_state()

The aggr_reset_state() function uses timer_delete() (non-synchronous)
for the aggregation timer before proceeding to delete TID state and
before the structure is freed by callers like aggr_module_destroy().

If the timer callback (aggr_timeout) is executing when aggr_reset_state()
is called, the callback will continue to access aggr_conn fields like
rx_tid[] and stat[] which may be freed immediately after by
kfree(aggr_info->aggr_conn) in aggr_module_destroy().

Additionally, the timer callback can re-arm itself via mod_timer() while
aggr_reset_state() is running, creating a more complex race condition.

Use timer_delete_sync() instead to ensure any running timer callback
has completed before returning.

Published: 2026-08-10

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ath6kl Wi‑Fi driver in the Linux kernel contains a use‑after‑free flaw caused by calling timer_delete() in aggr_reset_state() without ensuring that the timer callback has finished. If the callback (aggr_timeout) is executing when aggr_reset_state() runs, it may access memory that has already been freed by aggr_module_destroy(). This can corrupt kernel memory and may result in a system crash. The weakness is a classic use‑after‑free and race condition due to improper timer deletion (CWE‑825).

Affected Systems

All Linux kernel releases that include the ath6kl wireless driver are affected until the fix from commit 18965470d41e69d3fc10eb62afae29d10f4cdfd1 or later is applied. The advisory does not list specific version numbers, so any kernel with ath6kl support prior to this patch is potentially vulnerable.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity, while the EPSS score is < 1 %, suggesting low exploitation probability. The vulnerability arises from a race condition between a timer callback and a cleanup routine; successful exploitation would require triggering the race while the driver is active. There is no indication that the flaw is actively exploited and it is not currently listed in CISA’s KEV catalog, suggesting no known widespread exploitation at this time.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bdcd81707973cf8aa9305337166f8ee842a050d4`	affected	< a1bac650b2d6b1baab1f3e78e2e007a6e2948dde
`bdcd81707973cf8aa9305337166f8ee842a050d4`	affected	< 2132a6db05846dd2318857d00e0c1291f9e41b29
`bdcd81707973cf8aa9305337166f8ee842a050d4`	affected	< 17ff29cd8dbc977c97788a5f7c011ec807b58242
`bdcd81707973cf8aa9305337166f8ee842a050d4`	affected	< 64af6534a085f49d6ed33338a19ab9cf0d0523c9
`bdcd81707973cf8aa9305337166f8ee842a050d4`	affected	< b5d618fd61b9069b4c0a6b487022dd3117ad5acc
`bdcd81707973cf8aa9305337166f8ee842a050d4`	affected	< 18965470d41e69d3fc10eb62afae29d10f4cdfd1
`bdcd81707973cf8aa9305337166f8ee842a050d4`	affected	< a3313111b5d9046af60b370c93eec105b27380c1
`bdcd81707973cf8aa9305337166f8ee842a050d4`	affected	< ba7debb4dd6427386862220e8335a53a4bfc235d

Linux

affected

Version	Status	Constraints
`3.2`	affected	—
`0`	unaffected	< 3.2
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bdcd81707973cf8aa9305337166f8ee842a050d4,64af6534a085f49d6ed33338a19ab9cf0d0523c9)`	affected	code_commit	—
`[bdcd81707973cf8aa9305337166f8ee842a050d4,b5d618fd61b9069b4c0a6b487022dd3117ad5acc)`	affected	code_commit	—
`[bdcd81707973cf8aa9305337166f8ee842a050d4,18965470d41e69d3fc10eb62afae29d10f4cdfd1)`	affected	code_commit	—
`[bdcd81707973cf8aa9305337166f8ee842a050d4,a3313111b5d9046af60b370c93eec105b27380c1)`	affected	code_commit	—
`[bdcd81707973cf8aa9305337166f8ee842a050d4,ba7debb4dd6427386862220e8335a53a4bfc235d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.2`	affected	semver	—
`[0,3.2)`	unaffected	semver	—
`[6.6.151,6.7.0)`	unaffected	semver	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ath6kl use‑after‑free fix committed in 18965470d41e69d3fc10eb62afae29d10f4cdfd1.
If an immediate kernel update is not available, unload or blacklist the ath6kl driver so that the vulnerable code is not loaded.
As a last‑resort workaround, replace timer_delete() with timer_delete_sync() in aggr_reset_state(), rebuild the kernel, and install the patched kernel.

Generated by OpenCVE AI on August 13, 2026 at 23:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00274.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242
https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1
https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29
https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9
https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde
https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1
https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc
https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d
https://nvd.nist.gov/vuln/detail/CVE-2026-68198
https://www.cve.org/CVERecord?id=CVE-2026-68198

History

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242 https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29 https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde

Thu, 13 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 13 Aug 2026 07:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68198 https://www.cve.org/CVERecord?id=CVE-2026-68198
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Mon, 10 Aug 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.
Title		wifi: ath6kl: fix use-after-free in aggr_reset_state()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1 https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9 https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1 https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:00:16.718Z

Updated: 2026-08-23T12:46:06.548Z

Reserved: 2026-07-30T09:28:09.374Z

Link: CVE-2026-68198

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:07.277

Modified: 2026-08-23T13:16:35.023

Link: CVE-2026-68198

Redhat

Severity : Important

Publid Date: 2026-08-10T12:00:16Z

Links: CVE-2026-68198 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T23:45:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object