CVE-2026-68198

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68198", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.374Z", "datePublished": "2026-08-10T12:00:16.718Z", "dateUpdated": "2026-10-19T18:00:24.933Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:06.548Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - ath6kl is a WiFi driver; the race is driven by 802.11 frames from an adjacent attacker \u2014 a gapped A-MPDU sequence arms the reorder timer and a deauth/disassoc or connect/disconnect event drives aggr_reset_state() via ath6kl_disconnect_event()/ath6kl_connect_event()/ath6kl_sta_cleanup(). This requires radio proximity, not routable network access.\nAC:L - The attacker controls both sides of the race: transmitting out-of-order aggregated frames arms aggr_conn->timer, and a deauth/disassoc or reconnect immediately invokes aggr_reset_state(), which frees rx_tid[].hold_q and (via aggr_module_destroy) aggr_conn itself while aggr_timeout() may be running or re-arming via mod_timer(). The sequence can be repeated indefinitely until the window is hit.\nPR:N - No privileges or account on the target system are required; a rogue AP the client associates with, or an attacker injecting unprotected deauth/disassoc frames at a station with an active block-ack session, is sufficient. In AP mode, a station joining an open network can trigger the same path on disconnect.\nUI:N - The station already associated and receiving aggregated traffic is enough; deauth/disassoc handling and the resulting aggr_reset_state() run automatically in the driver with no action by the device owner.\nS:U - The use-after-free is on kernel heap memory owned by the ath6kl driver and stays within the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed aggr_info_conn and hold_q allocations can be reclaimed and refilled with attacker-influenced data (e.g. sk_buff payloads from injected frames), so the concurrent callback reading rx_tid[]/stat[]/hold_q[] yields a controllable read primitive that can leak kernel memory contents.\nI:H - aggr_timeout() writes through the freed object \u2014 setting timer_scheduled, rxtid->timer_mon, dequeuing skbs from hold_q[] and calling mod_timer() on a freed timer_list \u2014 giving arbitrary writes into reclaimed heap objects and list corruption that is a classic path to control-flow hijack.\nA:H - Even without successful heap grooming, the use-after-free and the double-free/dangling-skb access in aggr_deque_frms() reliably produce slab corruption and a kernel oops or panic, and the attacker can repeat the trigger at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath6kl/txrx.c"], "versions": [{"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "a1bac650b2d6b1baab1f3e78e2e007a6e2948dde", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "2132a6db05846dd2318857d00e0c1291f9e41b29", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "17ff29cd8dbc977c97788a5f7c011ec807b58242", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "64af6534a085f49d6ed33338a19ab9cf0d0523c9", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "b5d618fd61b9069b4c0a6b487022dd3117ad5acc", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "18965470d41e69d3fc10eb62afae29d10f4cdfd1", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "a3313111b5d9046af60b370c93eec105b27380c1", "status": "affected", "versionType": "git"}, {"version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "ba7debb4dd6427386862220e8335a53a4bfc235d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath6kl/txrx.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde"}, {"url": "https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29"}, {"url": "https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242"}, {"url": "https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9"}, {"url": "https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc"}, {"url": "https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1"}, {"url": "https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1"}, {"url": "https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"}], "title": "wifi: ath6kl: fix use-after-free in aggr_reset_state()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T15:45:39.924585Z", "id": "CVE-2026-68198", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:00:24.933Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68198", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:45:39.924585Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:45:40.500Z"}}], "cna": {"title": "wifi: ath6kl: fix use-after-free in aggr_reset_state()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - ath6kl is a WiFi driver; the race is driven by 802.11 frames from an adjacent attacker \u2014 a gapped A-MPDU sequence arms the reorder timer and a deauth/disassoc or connect/disconnect event drives aggr_reset_state() via ath6kl_disconnect_event()/ath6kl_connect_event()/ath6kl_sta_cleanup(). This requires radio proximity, not routable network access.\nAC:L - The attacker controls both sides of the race: transmitting out-of-order aggregated frames arms aggr_conn->timer, and a deauth/disassoc or reconnect immediately invokes aggr_reset_state(), which frees rx_tid[].hold_q and (via aggr_module_destroy) aggr_conn itself while aggr_timeout() may be running or re-arming via mod_timer(). The sequence can be repeated indefinitely until the window is hit.\nPR:N - No privileges or account on the target system are required; a rogue AP the client associates with, or an attacker injecting unprotected deauth/disassoc frames at a station with an active block-ack session, is sufficient. In AP mode, a station joining an open network can trigger the same path on disconnect.\nUI:N - The station already associated and receiving aggregated traffic is enough; deauth/disassoc handling and the resulting aggr_reset_state() run automatically in the driver with no action by the device owner.\nS:U - The use-after-free is on kernel heap memory owned by the ath6kl driver and stays within the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed aggr_info_conn and hold_q allocations can be reclaimed and refilled with attacker-influenced data (e.g. sk_buff payloads from injected frames), so the concurrent callback reading rx_tid[]/stat[]/hold_q[] yields a controllable read primitive that can leak kernel memory contents.\nI:H - aggr_timeout() writes through the freed object \u2014 setting timer_scheduled, rxtid->timer_mon, dequeuing skbs from hold_q[] and calling mod_timer() on a freed timer_list \u2014 giving arbitrary writes into reclaimed heap objects and list corruption that is a classic path to control-flow hijack.\nA:H - Even without successful heap grooming, the use-after-free and the double-free/dangling-skb access in aggr_deque_frms() reliably produce slab corruption and a kernel oops or panic, and the attacker can repeat the trigger at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "a1bac650b2d6b1baab1f3e78e2e007a6e2948dde", "versionType": "git"}, {"status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "2132a6db05846dd2318857d00e0c1291f9e41b29", "versionType": "git"}, {"status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "17ff29cd8dbc977c97788a5f7c011ec807b58242", "versionType": "git"}, {"status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "64af6534a085f49d6ed33338a19ab9cf0d0523c9", "versionType": "git"}, {"status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "b5d618fd61b9069b4c0a6b487022dd3117ad5acc", "versionType": "git"}, {"status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "18965470d41e69d3fc10eb62afae29d10f4cdfd1", "versionType": "git"}, {"status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "a3313111b5d9046af60b370c93eec105b27380c1", "versionType": "git"}, {"status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "ba7debb4dd6427386862220e8335a53a4bfc235d", "versionType": "git"}], "programFiles": ["drivers/net/wireless/ath/ath6kl/txrx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"status": "unaffected", "version": "0", "lessThan": "3.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.266", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.217", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/ath/ath6kl/txrx.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde"}, {"url": "https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29"}, {"url": "https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242"}, {"url": "https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9"}, {"url": "https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc"}, {"url": "https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1"}, {"url": "https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1"}, {"url": "https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.266", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.217", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.184", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.151", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.103", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:06.548Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68198", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:00:24.933Z", "dateReserved": "2026-07-30T09:28:09.374Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-10T12:00:16.718Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath6kl/txrx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a1bac650b2d6b1baab1f3e78e2e007a6e2948dde", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "2132a6db05846dd2318857d00e0c1291f9e41b29", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "17ff29cd8dbc977c97788a5f7c011ec807b58242", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "64af6534a085f49d6ed33338a19ab9cf0d0523c9", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "b5d618fd61b9069b4c0a6b487022dd3117ad5acc", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "18965470d41e69d3fc10eb62afae29d10f4cdfd1", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "a3313111b5d9046af60b370c93eec105b27380c1", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}, {"lessThan": "ba7debb4dd6427386862220e8335a53a4bfc235d", "status": "affected", "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath6kl/txrx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning."}], "id": "CVE-2026-68198", "lastModified": "2026-10-19T18:17:08.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68198", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:45:39.924585Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:20:07.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: Linux kernel: Use-after-free in ath6kl Wi-Fi driver leading to denial of service", "id": "2513182", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513182"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning.", "A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. A use-after-free vulnerability exists within the `aggr_reset_state()` function. This occurs because a non-synchronous timer deletion allows a timer callback (`aggr_timeout`) to access memory that has already been freed, creating a race condition. An attacker could potentially exploit this to cause system instability or a denial of service."], "name": "CVE-2026-68198", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:00:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68198\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68198\nhttps://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1\nhttps://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9\nhttps://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1\nhttps://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc\nhttps://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,64af6534a085f49d6ed33338a19ab9cf0d0523c9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,b5d618fd61b9069b4c0a6b487022dd3117ad5acc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,18965470d41e69d3fc10eb62afae29d10f4cdfd1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,a3313111b5d9046af60b370c93eec105b27380c1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bdcd81707973cf8aa9305337166f8ee842a050d4,ba7debb4dd6427386862220e8335a53a4bfc235d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T18:00:03.527336+00:00", "updated": "2026-10-19T20:15:03.910474+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}