Linux Kernel CVE-2026-68198

The vulnerability resides in the ath6kl kernel driver (CPE: cpe:2.3:a:linux:linux), which supports older Atheros SDIO/USB WiFi chipsets (AR6002, AR6003, AR6004 family). The root cause is a classic use-after-free (CWE-416, though NVD lists CWE as N/A - a data gap) arising from the non-synchronous nature of timer_delete(). Unlike timer_delete_sync(), the non-sync variant returns immediately without waiting for an in-progress timer callback to complete. The aggr_timeout callback accesses aggr_conn->rx_tid[] and aggr_conn->stat[]; these are freed via kfree(aggr_info->aggr_conn) in aggr_module_destroy() after aggr_reset_state() returns, creating a use-after-free window. A secondary race exists because aggr_timeout can re-arm itself via mod_timer() while aggr_reset_state() is running, potentially scheduling a new callback invocation after the struct is freed. The fix, present across all referenced stable commits, replaces timer_delete() with timer_delete_sync() to synchronize callback completion before any memory is released.