{"id":"CVE-2026-68198","state":"PUBLISHED","title":"wifi: ath6kl: fix use-after-free in aggr_reset_state()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning.","publishedAt":"2026-08-10T12:00:16.718Z","updatedAt":"2026-10-19T18:00:24.933Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"a1bac650b2d6b1baab1f3e78e2e007a6e2948dde","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"2132a6db05846dd2318857d00e0c1291f9e41b29","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"17ff29cd8dbc977c97788a5f7c011ec807b58242","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"64af6534a085f49d6ed33338a19ab9cf0d0523c9","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"b5d618fd61b9069b4c0a6b487022dd3117ad5acc","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"18965470d41e69d3fc10eb62afae29d10f4cdfd1","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"a3313111b5d9046af60b370c93eec105b27380c1","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"ba7debb4dd6427386862220e8335a53a4bfc235d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath6kl/txrx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.2","versionType":"semver"},{"version":"5.10.266","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.217","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.151","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath6kl/txrx.c"]}],"references":["https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde","https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29","https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242","https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9","https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc","https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1","https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1","https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68198.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68198","state":"PUBLISHED","datePublished":"2026-08-10T12:00:16.718Z","dateUpdated":"2026-10-19T18:00:24.933Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.374Z"},"containers":{"cna":{"title":"wifi: ath6kl: fix use-after-free in aggr_reset_state()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"a1bac650b2d6b1baab1f3e78e2e007a6e2948dde","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"2132a6db05846dd2318857d00e0c1291f9e41b29","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"17ff29cd8dbc977c97788a5f7c011ec807b58242","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"64af6534a085f49d6ed33338a19ab9cf0d0523c9","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"b5d618fd61b9069b4c0a6b487022dd3117ad5acc","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"18965470d41e69d3fc10eb62afae29d10f4cdfd1","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"a3313111b5d9046af60b370c93eec105b27380c1","versionType":"git"},{"version":"bdcd81707973cf8aa9305337166f8ee842a050d4","status":"affected","lessThan":"ba7debb4dd6427386862220e8335a53a4bfc235d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath6kl/txrx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.2","versionType":"semver"},{"version":"5.10.266","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.217","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.151","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath6kl/txrx.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde"},{"url":"https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29"},{"url":"https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242"},{"url":"https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9"},{"url":"https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc"},{"url":"https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1"},{"url":"https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1"},{"url":"https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - ath6kl is a WiFi driver; the race is driven by 802.11 frames from an adjacent attacker — a gapped A-MPDU sequence arms the reorder timer and a deauth/disassoc or connect/disconnect event drives aggr_reset_state() via ath6kl_disconnect_event()/ath6kl_connect_event()/ath6kl_sta_cleanup(). This requires radio proximity, not routable network access.\nAC:L - The attacker controls both sides of the race: transmitting out-of-order aggregated frames arms aggr_conn->timer, and a deauth/disassoc or reconnect immediately invokes aggr_reset_state(), which frees rx_tid[].hold_q and (via aggr_module_destroy) aggr_conn itself while aggr_timeout() may be running or re-arming via mod_timer(). The sequence can be repeated indefinitely until the window is hit.\nPR:N - No privileges or account on the target system are required; a rogue AP the client associates with, or an attacker injecting unprotected deauth/disassoc frames at a station with an active block-ack session, is sufficient. In AP mode, a station joining an open network can trigger the same path on disconnect.\nUI:N - The station already associated and receiving aggregated traffic is enough; deauth/disassoc handling and the resulting aggr_reset_state() run automatically in the driver with no action by the device owner.\nS:U - The use-after-free is on kernel heap memory owned by the ath6kl driver and stays within the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed aggr_info_conn and hold_q allocations can be reclaimed and refilled with attacker-influenced data (e.g. sk_buff payloads from injected frames), so the concurrent callback reading rx_tid[]/stat[]/hold_q[] yields a controllable read primitive that can leak kernel memory contents.\nI:H - aggr_timeout() writes through the freed object — setting timer_scheduled, rxtid->timer_mon, dequeuing skbs from hold_q[] and calling mod_timer() on a freed timer_list — giving arbitrary writes into reclaimed heap objects and list corruption that is a classic path to control-flow hijack.\nA:H - Even without successful heap grooming, the use-after-free and the double-free/dangling-skb access in aggr_deque_frms() reliably produce slab corruption and a kernel oops or panic, and the attacker can repeat the trigger at will."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-23T12:46:06.548Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"5.10.266"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"5.15.217"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.6.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-16T15:45:39.924585Z","id":"CVE-2026-68198","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","type":"CWE","lang":"en","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:00:24.933Z"}}]}}}