Use-after-free in Linux kernel - CVE-2026-68198

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in aggr_reset_state() in the ath6kl wireless driver when handling a race between timer callback execution and TID state teardown. A local user can trigger the race condition to cause a denial of service.

The timer callback may continue accessing rx_tid[] and stat[] fields after the associated aggr_conn structure is freed, and it can re-arm itself while the reset routine is running.

Affected software

How to mitigate CVE-2026-68198

External References

• https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1
• https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9
• https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1
• https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc
• https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d

Related Security Bulletins

• Use-after-free in Linux kernel ath ath6kl driver
• Debian update for linux