Cloudanix VulnDB

CVE-2026-68198

None

CVSS

—

EPSS

0.3%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A timing bug in certain Linux WiFi hardware drivers could let attackers crash computers or potentially take control by interfering with how the system cleans up network data handling.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in ath6kl WiFi driver aggregation state reset: non-synchronous timer_delete allows aggr_timeout callback to access rx_tid[]/stat[] fields after kfree of aggr_conn during module destroy; mod_timer re-arm during reset creates additional race.

Why it matters to the business

Kernel memory corruption on Linux systems using ath6kl WiFi hardware can cause crashes, denial of service, or potential privilege escalation; low EPSS and no known exploitation reduce immediate urgency but still requires patching to maintain driver stability.

How an attack unfolds

Attacker sends WiFi frames that trigger aggregation timer activity, then forces aggr_reset_state (via module unload or connection teardown) while the timer callback is executing; the callback dereferences freed aggr_conn structures, resulting in UAF that may be leveraged for memory corruption.

How to fix it

Apply the upstream fix that replaces timer_delete with timer_delete_sync in aggr_reset_state; rebuild and deploy updated Linux kernel containing the patch; reboot systems using ath6kl hardware after update.

How to confirm the fix worked

Confirm kernel source contains timer_delete_sync call in aggr_reset_state; run stress tests exercising aggregation reset under concurrent timer callbacks; verify no use-after-free reports in kernel memory debugging tools during WiFi load/unload cycles.

Typical attack path

  1. Establish or manipulate WiFi connection to activate ath6kl aggregation timers
  2. Trigger concurrent aggr_module_destroy or reset path while timer is armed
  3. Timer callback executes after structure free and accesses dangling rx_tid/stat pointers
  4. Achieve memory corruption or crash via freed-object reuse

How to detect it

Review kernel logs for ath6kl oops/panic traces involving aggr_reset_state or aggr_timeout; inspect for unexpected module unload sequences during active aggregation; correlate with WiFi frame patterns that rapidly toggle TID state.

What your security team should do

  • Prioritize kernel update for any systems exposing ath6kl WiFi interfaces
  • Monitor upstream stable branches for backported fix
  • Disable ath6kl module if hardware is not required until patched kernel is deployed
  • Include affected drivers in routine kernel patch testing cycles

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

Affected packages

Ecosystem Package Introduced Fixed