CVE-2026-68198
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.
- Affected products
- Linux Kernel
- Fix
- Available
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 0.3% (19th percentile)
- NVD status
- Received
- Published
- 2026-08-10
No indexed exploits for CVE-2026-68198 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-68198 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.