CVE-2026-68362 - Vulnerability Details

- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin

In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set
unconditionally even when ath11k_core_qmi_firmware_ready() fails.
This leaves the driver in an inconsistent state where
initialization is considered complete although the firmware ready
handling did not finish successfully. During the subsequent SSR,
the driver enters the restart path based on this incorrect state
and dereferences uninitialized srng members, resulting in a NULL
pointer dereference.

Call trace:
ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P)
ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k]
ath11k_core_restart+0x40/0x168 [ath11k]

Fix this by:
- skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set
- setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds
- setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling
on error

Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1

Published: 2026-08-10

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ath11k Wi‑Fi driver in the Linux kernel contains a flaw that permits a NULL pointer dereference during firmware‑ready handling. When the driver marks firmware as ready even after a failed initialization, a later system‑state‑reset sequence attempts to use uninitialized data structures, causing the kernel to crash. This flaw is an improper handling of state that leads to a kernel panic, which effectively denies service to the host. The flaw consists of both a NULL pointer dereference (CWE-476) and the use of uninitialised memory (CWE-824).

Affected Systems

The vulnerability affects the ath11k wireless stack bundled with the Linux kernel. All Linux kernels that include the ath11k driver prior to the inbound patch are impacted. The problem was observed on hardware such as the WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1, but the component is part of the generic kernel, so any distribution shipping the affected kernel may be vulnerable.

Risk and Exploitability

The EPSS score indicates a very low exploit probability (< 1 %), and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.7 denotes moderate severity. The flaw likely requires interaction with the Wi‑Fi interface—such as crafted traffic or a forced firmware reload—to trigger the firmware‑ready handling. While remote code execution is not described, the resulting kernel crash can serve as a denial‑of‑service vector and may allow further local attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6fe62a8cec51c756159c71be35a16b2cc8cbd4c0`	affected	< 66bf998b18334ca97321433e4ab783b6ff267e9d
`6fe62a8cec51c756159c71be35a16b2cc8cbd4c0`	affected	< e517e207300edcf7f3a8f6c45f9155c0e419ffb9
`6fe62a8cec51c756159c71be35a16b2cc8cbd4c0`	affected	< d6bba659ac30d862ee7bab92862cd6e514f07521
`6fe62a8cec51c756159c71be35a16b2cc8cbd4c0`	affected	< e5394605f9a985cc3a8263e610ba84b33cbe7b0c
`6fe62a8cec51c756159c71be35a16b2cc8cbd4c0`	affected	< 4abb4e284d8897176e91d7a3168ee29ed876bb41
`6fe62a8cec51c756159c71be35a16b2cc8cbd4c0`	affected	< e8d85672dd7e2523f774caafba8f858384e18df7

Linux

affected

Version	Status	Constraints
`6.1`	affected	—
`0`	unaffected	< 6.1
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6fe62a8cec51c756159c71be35a16b2cc8cbd4c0,e517e207300edcf7f3a8f6c45f9155c0e419ffb9)`	affected	code_commit	—
`[6fe62a8cec51c756159c71be35a16b2cc8cbd4c0,d6bba659ac30d862ee7bab92862cd6e514f07521)`	affected	code_commit	—
`[6fe62a8cec51c756159c71be35a16b2cc8cbd4c0,e5394605f9a985cc3a8263e610ba84b33cbe7b0c)`	affected	code_commit	—
`[6fe62a8cec51c756159c71be35a16b2cc8cbd4c0,4abb4e284d8897176e91d7a3168ee29ed876bb41)`	affected	code_commit	—
`[6fe62a8cec51c756159c71be35a16b2cc8cbd4c0,e8d85672dd7e2523f774caafba8f858384e18df7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.1`	affected	semver	—
`[0,6.1)`	unaffected	semver	—
`[6.6.148,7.0.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the ath11k driver patch (for example, any kernel that includes the commit that fixes the NULL pointer dereference).
Reboot the system after updating the kernel to load the new driver and verify that the Wi‑Fi interface operates normally.
If an immediate kernel upgrade is not feasible, temporarily unload or disable the ath11k module to prevent firmware‑ready handling, or isolate the device external wireless traffic that could trigger a firmware reload.

Generated by OpenCVE AI on August 12, 2026 at 18:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4abb4e284d8897176e91d7a3168ee29ed876bb41
https://git.kernel.org/stable/c/66bf998b18334ca97321433e4ab783b6ff267e9d
https://git.kernel.org/stable/c/d6bba659ac30d862ee7bab92862cd6e514f07521
https://git.kernel.org/stable/c/e517e207300edcf7f3a8f6c45f9155c0e419ffb9
https://git.kernel.org/stable/c/e5394605f9a985cc3a8263e610ba84b33cbe7b0c
https://git.kernel.org/stable/c/e8d85672dd7e2523f774caafba8f858384e18df7
https://nvd.nist.gov/vuln/detail/CVE-2026-68362
https://www.cve.org/CVERecord?id=CVE-2026-68362

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/66bf998b18334ca97321433e4ab783b6ff267e9d

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68362 https://www.cve.org/CVERecord?id=CVE-2026-68362
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leaves the driver in an inconsistent state where initialization is considered complete although the firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a NULL pointer dereference. Call trace: ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P) ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k] ath11k_core_restart+0x40/0x168 [ath11k] Fix this by: - skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set - setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds - setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling on error Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1
Title		wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4abb4e284d8897176e91d7a3168ee29ed876bb41 https://git.kernel.org/stable/c/d6bba659ac30d862ee7bab92862cd6e514f07521 https://git.kernel.org/stable/c/e517e207300edcf7f3a8f6c45f9155c0e419ffb9 https://git.kernel.org/stable/c/e5394605f9a985cc3a8263e610ba84b33cbe7b0c https://git.kernel.org/stable/c/e8d85672dd7e2523f774caafba8f858384e18df7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:03:39.363Z

Updated: 2026-08-19T16:34:15.793Z

Reserved: 2026-07-30T09:28:09.385Z

Link: CVE-2026-68362

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:28.750

Modified: 2026-08-19T17:20:45.827

Link: CVE-2026-68362

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:03:39Z

Links: CVE-2026-68362 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-12T19:00:08Z

Weaknesses

CWE-476
NULL Pointer Dereference
CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object