CVE-2026-68191
Received Received - Intake

NULL Pointer Dereference in ath12k WiFi Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irq_work_sync() called from rhashtable_destroy(). Two hash tables are affected: 1. ath12k_link_sta hash table in ath12k_base 2. ath12k_dp_link_peer hash table in ath12k_dp The issue happens because the destroy functions are called unconditionally in cleanup paths, but the hash tables are only initialized late in their respective init functions. If the device was never fully started or if the init functions failed before initializing the hash tables, the pointers will be NULL. The issues are always reproducible from a VM because the MSI addressing initialization is failing. Call trace for ath12k_link_sta_rhash_tbl_destroy: RIP: irq_work_sync+0x1e/0x70 rhashtable_destroy+0x12/0x60 ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k] ath12k_core_stop+0xe/0x80 [ath12k] ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k] ath12k_pci_remove+0x60/0x110 [ath12k] Call trace for ath12k_dp_link_peer_rhash_tbl_destroy: RIP: irq_work_sync+0x1e/0x70 rhashtable_destroy+0x12/0x60 ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k] ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k] ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k] ath12k_pci_remove+0x60/0x110 [ath12k] Fix this by adding NULL checks before calling rhashtable_destroy() in both destroy functions. The NULL check approach was chosen because the rhashtable pointer serves as the initialization state indicator. The init can fail at various points, leaving some components uninitialized. Checking the pointer directly is simpler than adding separate state flags that would need synchronization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68191
EUVD
EUVD-2026-55292

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the Linux kernel's ath12k Wi-Fi driver. It occurs when unbinding the driver, causing kernel crashes due to improper cleanup of hash tables. The issue arises because destroy functions are called unconditionally, but hash tables may not be initialized if device startup fails. This leads to NULL pointers being passed to rhashtable_destroy().

Detection Guidance

This vulnerability is specific to systems using the ath12k Wi-Fi driver in the Linux kernel. Detection involves checking if the system is running a vulnerable kernel version and if the ath12k driver is loaded. Commands like 'uname -a' to check kernel version and 'lsmod | grep ath12k' to verify driver loading can help. If the driver is loaded and the kernel is vulnerable, the issue may manifest during driver unloading or system cleanup.

Impact Analysis

If exploited, this vulnerability can cause system crashes or instability when unloading the ath12k driver. It may lead to denial-of-service conditions on affected systems using Qualcomm Wi-Fi chips. The issue is reproducible from virtual machines due to MSI addressing failures.

Mitigation Strategies

Apply the kernel patch that adds NULL checks before calling rhashtable_destroy() in the ath12k driver's destroy functions. This prevents NULL pointer dereferences during cleanup. Update to a kernel version containing the fix or manually apply the patch if available for your distribution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68191. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart