SB20260812338 - Use-after-free in Linux kernel ath ath6kl driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-68198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aggr_reset_state() in the ath6kl wireless driver when handling a race between timer callback execution and TID state teardown. A local user can trigger the race condition to cause a denial of service.

The timer callback may continue accessing rx_tid[] and stat[] fields after the associated aggr_conn structure is freed, and it can re-arm itself while the reset routine is running.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1
• https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9
• https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1
• https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc
• https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d