Cloudanix VulnDB

CVE-2026-68363

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux Wi-Fi drivers can let a USB device cause the kernel to read memory that has already been freed, potentially crashing the system.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free read of hif_dev structure (specifically hif_dev->udev) in ath9k_hif_request_firmware after request_firmware_nowait re-arms an asynchronous firmware load; the trailing dev_info call occurs after the firmware callback chain may have already triggered ath9k_hif_usb_disconnect to kfree hif_dev via the fw_done completion.

Why it matters to the business

Kernel crashes or memory corruption on systems using ath9k_htc USB Wi-Fi devices when firmware loading fails during device connect or disconnect, leading to potential denial of service for wireless connectivity.

How an attack unfolds

An attacker with physical or USB-gadget access connects an ath9k_htc device configured to fail firmware download; the race between the re-armed request_firmware_nowait callback and concurrent disconnect frees hif_dev while ath9k_hif_request_firmware still dereferences it, triggering KASAN-detected slab-use-after-free.

How to fix it

Apply the upstream fix that removes the informational dev_info call after request_firmware_nowait; rebuild and deploy the patched Linux kernel for affected ath9k driver versions.

How to confirm the fix worked

Confirm the dev_info line after request_firmware_nowait is absent in hif_usb.c; reproduce the race with USB connect/disconnect under KASAN and verify no slab-use-after-free is reported.

Typical attack path

  1. Attach ath9k_htc USB device that returns failure on firmware request
  2. Trigger ath9k_hif_usb_probe which calls ath9k_hif_request_firmware
  3. request_firmware_nowait re-arms async load and passes hif_dev as context
  4. Concurrent disconnect path completes fw_done and kfree's hif_dev
  5. Post-request dev_info in ath9k_hif_request_firmware reads freed memory

How to detect it

Search kernel logs and KASAN reports for ath9k_hif_request_firmware, hif_usb.c:1247, or slab-use-after-free involving hif_device_usb during USB attach/detach sequences.

What your security team should do

  • Prioritize kernel update for any system exposing ath9k_htc USB Wi-Fi to untrusted devices
  • Monitor kernel logs for KASAN or use-after-free reports involving ath9k_hif_request_firmware
  • Disable or replace ath9k_htc hardware where firmware reliability cannot be guaranteed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completion context, and then still dereferences hif_dev: dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n", hif_dev->fw_name); The re-armed callback ath9k_hif_usb_firmware_cb() runs on the "events" workqueue and, when the firmware is missing, walks the retry chain into ath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That releases the wait_for_completion(&hif_dev->fw_done) in a concurrent ath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing dev_info() in the frame that re-armed the request can therefore read freed memory (hif_dev->udev, the first field of struct hif_device_usb): BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware Read of size 8 ... by task kworker/... ath9k_hif_request_firmware ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247 request_firmware_work_func Allocated by ...: ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c Freed by ...: ath9k_hif_usb_disconnect -> kfree drivers/net/wireless/ath/ath9k/hif_usb.c The fw_done barrier only makes disconnect wait for the firmware chain to *terminate*; it does not protect the outer ath9k_hif_request_firmware() frame that re-armed the request and keeps touching hif_dev afterwards. Drop the post-request dev_info(): it is the only use of hif_dev after the async request is armed, and it is purely informational (the dev_err() on the failure path runs only when request_firmware_nowait() did not arm a callback, so hif_dev is still alive there). This was first reported by syzbot as a single, non-reproduced crash that was later auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer, which produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc device whose firmware download fails). The vulnerable code is unchanged and still present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN once the (sub-microsecond) race window is widened.

Affected packages

Ecosystem Package Introduced Fixed