Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-68198

Опубликовано: 10 авг. 2026
Источник: redhat
CVSS3: 5.5
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. A use-after-free vulnerability exists within the aggr_reset_state() function. This occurs because a non-synchronous timer deletion allows a timer callback (aggr_timeout) to access memory that has already been freed, creating a race condition. An attacker could potentially exploit this to cause system instability or a denial of service.

Отчет

This is a use-after-free flaw in the ath6kl Wi-Fi driver of the Linux kernel. This vulnerability could allow a local attacker to cause a denial of service by triggering a race condition in the aggregation state reset function. Exploitation requires the presence and active use of specific Qualcomm Atheros wireless hardware.

Меры по смягчению последствий

To mitigate this issue, prevent the ath6kl kernel module from loading. This can be achieved by creating a blacklist file.

  1. Create a file named /etc/modprobe.d/blacklist-ath6kl.conf with the following content:
blacklist ath6kl install ath6kl /bin/true
  1. Regenerate the initramfs to ensure the blacklist is applied during boot: For RHEL 7:
dracut -f -v

For RHEL 8 and 9:

dracut -f --regenerate-all
  1. Reboot the system for the changes to take effect. This mitigation will disable functionality provided by the ath6kl driver, which may impact systems relying on specific Qualcomm Atheros wireless chipsets.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 10kernelNot affected
Red Hat Enterprise Linux 6kernelNot affected
Red Hat Enterprise Linux 7kernelAffected
Red Hat Enterprise Linux 7kernel-rtAffected
Red Hat Enterprise Linux 8kernelAffected
Red Hat Enterprise Linux 8kernel-rtAffected
Red Hat Enterprise Linux 9kernelAffected
Red Hat Enterprise Linux 9kernel-rtAffected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-825
https://bugzilla.redhat.com/show_bug.cgi?id=2513182kernel: Linux kernel: Use-after-free in ath6kl Wi-Fi driver leading to denial of service

EPSS

Процентиль: 19%
0.00274
Низкий

5.5 Medium

CVSS3

Связанные уязвимости

CVSS3: 8.8
ubuntu
22 дня назад

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

CVSS3: 8.8
nvd
22 дня назад

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

msrc
21 день назад

wifi: ath6kl: fix use-after-free in aggr_reset_state()

CVSS3: 8.8
debian
22 дня назад

In the Linux kernel, the following vulnerability has been resolved: w ...

CVSS3: 8.8
github
22 дня назад

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

EPSS

Процентиль: 19%
0.00274
Низкий

5.5 Medium

CVSS3