CVE-2026-68191

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68191", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.373Z", "datePublished": "2026-08-10T12:00:09.069Z", "dateUpdated": "2026-08-17T05:00:33.856Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:00:33.856Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix NULL pointer dereference in rhash table destroy\n\nWhen unbinding the ath12k driver, kernel NULL pointer dereferences\noccur in irq_work_sync() called from rhashtable_destroy().\n\nTwo hash tables are affected:\n1. ath12k_link_sta hash table in ath12k_base\n2. ath12k_dp_link_peer hash table in ath12k_dp\n\nThe issue happens because the destroy functions are called unconditionally\nin cleanup paths, but the hash tables are only initialized late in their\nrespective init functions. If the device was never fully started or if the\ninit functions failed before initializing the hash tables, the pointers\nwill be NULL. The issues are always reproducible from a VM because the MSI\naddressing initialization is failing.\n\nCall trace for ath12k_link_sta_rhash_tbl_destroy:\n RIP: irq_work_sync+0x1e/0x70\n rhashtable_destroy+0x12/0x60\n ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]\n ath12k_core_stop+0xe/0x80 [ath12k]\n ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]\n ath12k_pci_remove+0x60/0x110 [ath12k]\n\nCall trace for ath12k_dp_link_peer_rhash_tbl_destroy:\n RIP: irq_work_sync+0x1e/0x70\n rhashtable_destroy+0x12/0x60\n ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]\n ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]\n ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]\n ath12k_pci_remove+0x60/0x110 [ath12k]\n\nFix this by adding NULL checks before calling rhashtable_destroy() in\nboth destroy functions.\n\nThe NULL check approach was chosen because the rhashtable pointer\nserves as the initialization state indicator. The init can fail at\nvarious points, leaving some components uninitialized. Checking the\npointer directly is simpler than adding separate state flags that\nwould need synchronization."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath12k/dp_peer.c", "drivers/net/wireless/ath/ath12k/peer.c"], "versions": [{"version": "57ccca410237285f8f25a988655e6910cadc63f2", "lessThan": "17a4298f7794843af0094035723dc5e7311c7453", "status": "affected", "versionType": "git"}, {"version": "57ccca410237285f8f25a988655e6910cadc63f2", "lessThan": "70231dcd782201579990ded73e0435d18bb524ca", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath12k/dp_peer.c", "drivers/net/wireless/ath/ath12k/peer.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/17a4298f7794843af0094035723dc5e7311c7453"}, {"url": "https://git.kernel.org/stable/c/70231dcd782201579990ded73e0435d18bb524ca"}], "title": "wifi: ath12k: fix NULL pointer dereference in rhash table destroy", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath12k/dp_peer.c", "drivers/net/wireless/ath/ath12k/peer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "17a4298f7794843af0094035723dc5e7311c7453", "status": "affected", "version": "57ccca410237285f8f25a988655e6910cadc63f2", "versionType": "git"}, {"lessThan": "70231dcd782201579990ded73e0435d18bb524ca", "status": "affected", "version": "57ccca410237285f8f25a988655e6910cadc63f2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath12k/dp_peer.c", "drivers/net/wireless/ath/ath12k/peer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix NULL pointer dereference in rhash table destroy\n\nWhen unbinding the ath12k driver, kernel NULL pointer dereferences\noccur in irq_work_sync() called from rhashtable_destroy().\n\nTwo hash tables are affected:\n1. ath12k_link_sta hash table in ath12k_base\n2. ath12k_dp_link_peer hash table in ath12k_dp\n\nThe issue happens because the destroy functions are called unconditionally\nin cleanup paths, but the hash tables are only initialized late in their\nrespective init functions. If the device was never fully started or if the\ninit functions failed before initializing the hash tables, the pointers\nwill be NULL. The issues are always reproducible from a VM because the MSI\naddressing initialization is failing.\n\nCall trace for ath12k_link_sta_rhash_tbl_destroy:\n RIP: irq_work_sync+0x1e/0x70\n rhashtable_destroy+0x12/0x60\n ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]\n ath12k_core_stop+0xe/0x80 [ath12k]\n ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]\n ath12k_pci_remove+0x60/0x110 [ath12k]\n\nCall trace for ath12k_dp_link_peer_rhash_tbl_destroy:\n RIP: irq_work_sync+0x1e/0x70\n rhashtable_destroy+0x12/0x60\n ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]\n ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]\n ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]\n ath12k_pci_remove+0x60/0x110 [ath12k]\n\nFix this by adding NULL checks before calling rhashtable_destroy() in\nboth destroy functions.\n\nThe NULL check approach was chosen because the rhashtable pointer\nserves as the initialization state indicator. The init can fail at\nvarious points, leaving some components uninitialized. Checking the\npointer directly is simpler than adding separate state flags that\nwould need synchronization."}], "id": "CVE-2026-68191", "lastModified": "2026-08-17T05:18:20.913", "metrics": {}, "published": "2026-08-10T13:20:06.433", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/17a4298f7794843af0094035723dc5e7311c7453"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/70231dcd782201579990ded73e0435d18bb524ca"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: ath12k Wi-Fi driver NULL pointer dereference leads to system crash", "id": "2513269", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513269"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: ath12k: fix NULL pointer dereference in rhash table destroy\nWhen unbinding the ath12k driver, kernel NULL pointer dereferences\noccur in irq_work_sync() called from rhashtable_destroy().\nTwo hash tables are affected:\n1. ath12k_link_sta hash table in ath12k_base\n2. ath12k_dp_link_peer hash table in ath12k_dp\nThe issue happens because the destroy functions are called unconditionally\nin cleanup paths, but the hash tables are only initialized late in their\nrespective init functions. If the device was never fully started or if the\ninit functions failed before initializing the hash tables, the pointers\nwill be NULL. The issues are always reproducible from a VM because the MSI\naddressing initialization is failing.\nCall trace for ath12k_link_sta_rhash_tbl_destroy:\nRIP: irq_work_sync+0x1e/0x70\nrhashtable_destroy+0x12/0x60\nath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]\nath12k_core_stop+0xe/0x80 [ath12k]\nath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]\nath12k_pci_remove+0x60/0x110 [ath12k]\nCall trace for ath12k_dp_link_peer_rhash_tbl_destroy:\nRIP: irq_work_sync+0x1e/0x70\nrhashtable_destroy+0x12/0x60\nath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]\nath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]\nath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]\nath12k_pci_remove+0x60/0x110 [ath12k]\nFix this by adding NULL checks before calling rhashtable_destroy() in\nboth destroy functions.\nThe NULL check approach was chosen because the rhashtable pointer\nserves as the initialization state indicator. The init can fail at\nvarious points, leaving some components uninitialized. Checking the\npointer directly is simpler than adding separate state flags that\nwould need synchronization.", "A flaw was found in the Linux kernel's ath12k Wi-Fi driver. When the ath12k driver is unbound, a NULL pointer dereference can occur in the rhash table destroy functions. This issue arises because the hash tables may not be fully initialized before their destroy functions are called unconditionally during cleanup. An attacker could potentially trigger this condition, leading to a kernel NULL pointer dereference and a system crash, resulting in a denial of service."], "name": "CVE-2026-68191", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:00:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68191\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68191\nhttps://git.kernel.org/stable/c/17a4298f7794843af0094035723dc5e7311c7453\nhttps://git.kernel.org/stable/c/70231dcd782201579990ded73e0435d18bb524ca"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57ccca410237285f8f25a988655e6910cadc63f2,17a4298f7794843af0094035723dc5e7311c7453)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57ccca410237285f8f25a988655e6910cadc63f2,70231dcd782201579990ded73e0435d18bb524ca)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T14:30:04.128504+00:00", "updated": "2026-08-13T10:00:05.005379+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}