{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68198", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.374Z", "datePublished": "2026-08-10T12:00:16.718Z", "dateUpdated": "2026-08-23T12:46:06.548Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:06.548Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - ath6kl is a WiFi driver; the race is driven by 802.11 frames from an adjacent attacker — a gapped A-MPDU sequence arms the reorder timer and a deauth/disassoc or connect/disconnect event drives aggr_reset_state() via ath6kl_disconnect_event()/ath6kl_connect_event()/ath6kl_sta_cleanup(). This requires radio proximity, not routable network access.\nAC:L - The attacker controls both sides of the race: transmitting out-of-order aggregated frames arms aggr_conn->timer, and a deauth/disassoc or reconnect immediately invokes aggr_reset_state(), which frees rx_tid[].hold_q and (via aggr_module_destroy) aggr_conn itself while aggr_timeout() may be running or re-arming via mod_timer(). The sequence can be repeated indefinitely until the window is hit.\nPR:N - No privileges or account on the target system are required; a rogue AP the client associates with, or an attacker injecting unprotected deauth/disassoc frames at a station with an active block-ack session, is sufficient. In AP mode, a station joining an open network can trigger the same path on disconnect.\nUI:N - The station already associated and receiving aggregated traffic is enough; deauth/disassoc handling and the resulting aggr_reset_state() run automatically in the driver with no action by the device owner.\nS:U - The use-after-free is on kernel heap memory owned by the ath6kl driver and stays within the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed aggr_info_conn and hold_q allocations can be reclaimed and refilled with attacker-influenced data (e.g. sk_buff payloads from injected frames), so the concurrent callback reading rx_tid[]/stat[]/hold_q[] yields a controllable read primitive that can leak kernel memory contents.\nI:H - aggr_timeout() writes through the freed object — setting timer_scheduled, rxtid->timer_mon, dequeuing skbs from hold_q[] and calling mod_timer() on a freed timer_list — giving arbitrary writes into reclaimed heap objects and list corruption that is a classic path to control-flow hijack.\nA:H - Even without successful heap grooming, the use-after-free and the double-free/dangling-skb access in aggr_deque_frms() reliably produce slab corruption and a kernel oops or panic, and the attacker can repeat the trigger at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath6kl/txrx.c" ], "versions": [ { "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "a1bac650b2d6b1baab1f3e78e2e007a6e2948dde", "status": "affected", "versionType": "git" }, { "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "2132a6db05846dd2318857d00e0c1291f9e41b29", "status": "affected", "versionType": "git" }, { "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "17ff29cd8dbc977c97788a5f7c011ec807b58242", "status": "affected", "versionType": "git" }, { "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "64af6534a085f49d6ed33338a19ab9cf0d0523c9", "status": "affected", "versionType": "git" }, { "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "b5d618fd61b9069b4c0a6b487022dd3117ad5acc", "status": "affected", "versionType": "git" }, { "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "18965470d41e69d3fc10eb62afae29d10f4cdfd1", "status": "affected", "versionType": "git" }, { "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "a3313111b5d9046af60b370c93eec105b27380c1", "status": "affected", "versionType": "git" }, { "version": "bdcd81707973cf8aa9305337166f8ee842a050d4", "lessThan": "ba7debb4dd6427386862220e8335a53a4bfc235d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath6kl/txrx.c" ], "versions": [ { "version": "3.2", "status": "affected" }, { "version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.10.266" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.217" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.184" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.151" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde" }, { "url": "https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29" }, { "url": "https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242" }, { "url": "https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9" }, { "url": "https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc" }, { "url": "https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1" }, { "url": "https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1" }, { "url": "https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d" } ], "title": "wifi: ath6kl: fix use-after-free in aggr_reset_state()", "x_generator": { "engine": "bippy-1.2.0" } } } }