CVE-2026-68198
Received Received - Intake

Use-After-Free in Linux Kernel WiFi ath6kl Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68198
EUVD
EUVD-2026-55299

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's ath6kl Wi-Fi driver. The aggr_reset_state() function improperly deletes an aggregation timer using timer_delete() without waiting for its callback to finish. If the timer callback runs during deletion, it may access freed memory in aggr_conn fields like rx_tid[] and stat[]. The timer can also re-arm itself, creating a race condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's ath6kl Wi-Fi driver and requires kernel-level detection. There are no direct user-space commands to detect this issue. Monitoring kernel logs for crashes or warnings related to ath6kl or timer operations may indicate exploitation. Check for kernel oops messages or system hangs during Wi-Fi operations.

Impact Analysis

This could lead to system crashes, kernel memory corruption, or privilege escalation if exploited. Attackers on the same network might trigger the flaw to cause denial-of-service or execute arbitrary code in the kernel.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-68198. The fix replaces timer_delete() with timer_delete_sync() in the ath6kl driver to prevent the use-after-free condition. Contact your Linux distribution vendor for an updated kernel package.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart