{"api_version":"1","generated_at":"2026-10-26T15:01:04+00:00","cve":"CVE-2026-68198","urls":{"html":"https://cve.report/CVE-2026-68198","api":"https://cve.report/api/cve/CVE-2026-68198.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68198","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68198"},"summary":{"title":"wifi: ath6kl: fix use-after-free in aggr_reset_state()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:07","updated_at":"2026-10-19 18:17:08"},"problem_types":["CWE-416","CWE-416 CWE-416 Use After Free"],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1","name":"https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d","name":"https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde","name":"https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc","name":"https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29","name":"https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1","name":"https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9","name":"https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242","name":"https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68198","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68198","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 a1bac650b2d6b1baab1f3e78e2e007a6e2948dde git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 2132a6db05846dd2318857d00e0c1291f9e41b29 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 17ff29cd8dbc977c97788a5f7c011ec807b58242 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 64af6534a085f49d6ed33338a19ab9cf0d0523c9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 b5d618fd61b9069b4c0a6b487022dd3117ad5acc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 18965470d41e69d3fc10eb62afae29d10f4cdfd1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 a3313111b5d9046af60b370c93eec105b27380c1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bdcd81707973cf8aa9305337166f8ee842a050d4 ba7debb4dd6427386862220e8335a53a4bfc235d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.2","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.2 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.266 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.217 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.184 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.151 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.103 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68198","cve":"CVE-2026-68198","epss":"0.002740000","percentile":"0.185480000","score_date":"2026-10-19","updated_at":"2026-10-20 00:13:48"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-68198","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:45:39.924585Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"CWE-416 Use After Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-19T18:00:24.933Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ath/ath6kl/txrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a1bac650b2d6b1baab1f3e78e2e007a6e2948dde","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"2132a6db05846dd2318857d00e0c1291f9e41b29","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"17ff29cd8dbc977c97788a5f7c011ec807b58242","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"64af6534a085f49d6ed33338a19ab9cf0d0523c9","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"b5d618fd61b9069b4c0a6b487022dd3117ad5acc","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"18965470d41e69d3fc10eb62afae29d10f4cdfd1","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"a3313111b5d9046af60b370c93eec105b27380c1","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"},{"lessThan":"ba7debb4dd6427386862220e8335a53a4bfc235d","status":"affected","version":"bdcd81707973cf8aa9305337166f8ee842a050d4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ath/ath6kl/txrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.266","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.217","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.184","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.151","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.103","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.266","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.217","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.184","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.151","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.103","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"3.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:A - ath6kl is a WiFi driver; the race is driven by 802.11 frames from an adjacent attacker — a gapped A-MPDU sequence arms the reorder timer and a deauth/disassoc or connect/disconnect event drives aggr_reset_state() via ath6kl_disconnect_event()/ath6kl_connect_event()/ath6kl_sta_cleanup(). This requires radio proximity, not routable network access.\nAC:L - The attacker controls both sides of the race: transmitting out-of-order aggregated frames arms aggr_conn->timer, and a deauth/disassoc or reconnect immediately invokes aggr_reset_state(), which frees rx_tid[].hold_q and (via aggr_module_destroy) aggr_conn itself while aggr_timeout() may be running or re-arming via mod_timer(). The sequence can be repeated indefinitely until the window is hit.\nPR:N - No privileges or account on the target system are required; a rogue AP the client associates with, or an attacker injecting unprotected deauth/disassoc frames at a station with an active block-ack session, is sufficient. In AP mode, a station joining an open network can trigger the same path on disconnect.\nUI:N - The station already associated and receiving aggregated traffic is enough; deauth/disassoc handling and the resulting aggr_reset_state() run automatically in the driver with no action by the device owner.\nS:U - The use-after-free is on kernel heap memory owned by the ath6kl driver and stays within the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed aggr_info_conn and hold_q allocations can be reclaimed and refilled with attacker-influenced data (e.g. sk_buff payloads from injected frames), so the concurrent callback reading rx_tid[]/stat[]/hold_q[] yields a controllable read primitive that can leak kernel memory contents.\nI:H - aggr_timeout() writes through the freed object — setting timer_scheduled, rxtid->timer_mon, dequeuing skbs from hold_q[] and calling mod_timer() on a freed timer_list — giving arbitrary writes into reclaimed heap objects and list corruption that is a classic path to control-flow hijack.\nA:H - Even without successful heap grooming, the use-after-free and the double-free/dangling-skb access in aggr_deque_frms() reliably produce slab corruption and a kernel oops or panic, and the attacker can repeat the trigger at will."}]}],"providerMetadata":{"dateUpdated":"2026-08-23T12:46:06.548Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde"},{"url":"https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29"},{"url":"https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242"},{"url":"https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9"},{"url":"https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc"},{"url":"https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1"},{"url":"https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1"},{"url":"https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"}],"title":"wifi: ath6kl: fix use-after-free in aggr_reset_state()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68198","datePublished":"2026-08-10T12:00:16.718Z","dateReserved":"2026-07-30T09:28:09.374Z","dateUpdated":"2026-10-19T18:00:24.933Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:07","lastModifiedDate":"2026-10-19 18:17:08","problem_types":["CWE-416","CWE-416 CWE-416 Use After Free"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T15:45:39.924585Z","id":"CVE-2026-68198","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68198","Ordinal":"1","Title":"wifi: ath6kl: fix use-after-free in aggr_reset_state()","CVE":"CVE-2026-68198","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68198","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning.","Type":"Description","Title":"wifi: ath6kl: fix use-after-free in aggr_reset_state()"}]}}}