Answer in brief
CVE-2026-68198 records a Unknown severity vulnerability in wifi: ath6kl: fix use-after-free in aggr_reset_state(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=bdcd81707973cf8aa9305337166f8ee842a050d4 <64af6534a085f49d6ed33338a19ab9cf0d0523c9 || >=bdcd81707973cf8aa9305337166f8ee842a050d4 <b5d618fd61b9069b4c0a6b487022dd3117ad5acc || >=bdcd81707973cf8aa9305337166f8ee842a050d4 <18965470d41e69d3fc10eb62afae29d10f4cdfd1 || >=bdcd81707973cf8aa9305337166f8ee842a050d4 <a3313111b5d9046af60b370c93eec105b27380c1 || >=bdcd81707973cf8aa9305337166f8ee842a050d4 <ba7debb4dd6427386862220e8335a53a4bfc235d | 64af6534a085f49d6ed33338a19ab9cf0d0523c9, b5d618fd61b9069b4c0a6b487022dd3117ad5acc, 18965470d41e69d3fc10eb62afae29d10f4cdfd1, a3313111b5d9046af60b370c93eec105b27380c1, ba7debb4dd6427386862220e8335a53a4bfc235d |
| Linux/Linuxgeneric | 3.2 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68198 records a Unknown severity vulnerability in wifi: ath6kl: fix use-after-free in aggr_reset_state(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=bdcd81707973cf8aa9305337166f8ee842a050d4 <64af6534a085f49d6ed33338a19ab9cf0d0523c9 || >=bdcd81707973cf8aa9305337166f8ee842a050d4 <b5d618fd61b9069b4c0a6b487022dd3117ad5acc || >=bdcd81707973cf8aa9305337166f8ee842a050d4 <18965470d41e69d3fc10eb62afae29d10f4cdfd1 || >=bdcd81707973cf8aa9305337166f8ee842a050d4 <a3313111b5d9046af60b370c93eec105b27380c1 || >=bdcd81707973cf8aa9305337166f8ee842a050d4 <ba7debb4dd6427386862220e8335a53a4bfc235d | 64af6534a085f49d6ed33338a19ab9cf0d0523c9, b5d618fd61b9069b4c0a6b487022dd3117ad5acc, 18965470d41e69d3fc10eb62afae29d10f4cdfd1, a3313111b5d9046af60b370c93eec105b27380c1, ba7debb4dd6427386862220e8335a53a4bfc235d |
| Linux/Linuxgeneric | 3.2 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.
Quoted source text, attributed separately from HOL analysis.