Skip to main content

Linux Kernel EUVDEUVD-2026-55299

| CVE-2026-68198 HIGH
2026-08-10 Linux GHSA-mrq7-mrhj-vm2g
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Race condition exploitation requires precise timing between timer callback and teardown, warranting AC:H; AV:A and PR:N retained as WiFi adjacency and no authentication are confirmed by description.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:38 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:00 cve.org
HIGH 8.8
CVE Published
Aug 10, 2026 - 12:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix use-after-free in aggr_reset_state()

The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy().

If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy().

Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition.

Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.

AnalysisAI

Use-after-free in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros WiFi hardware to potential kernel memory corruption via a timer-callback race condition. The vulnerable aggr_reset_state() function calls non-synchronous timer_delete(), leaving a window in which the aggr_timeout callback continues accessing aggr_conn->rx_tid[] and aggr_conn->stat[] after those structures are freed by aggr_module_destroy(). Vendor-released patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.42, 7.1.6, 7.2-rc5), no public exploit has been identified, and EPSS stands at 0.18%, reflecting low observed exploitation activity.

Technical ContextAI

The vulnerability resides in the ath6kl kernel driver (CPE: cpe:2.3:a:linux:linux), which supports older Atheros SDIO/USB WiFi chipsets (AR6002, AR6003, AR6004 family). The root cause is a classic use-after-free (CWE-416, though NVD lists CWE as N/A - a data gap) arising from the non-synchronous nature of timer_delete(). Unlike timer_delete_sync(), the non-sync variant returns immediately without waiting for an in-progress timer callback to complete. The aggr_timeout callback accesses aggr_conn->rx_tid[] and aggr_conn->stat[]; these are freed via kfree(aggr_info->aggr_conn) in aggr_module_destroy() after aggr_reset_state() returns, creating a use-after-free window. A secondary race exists because aggr_timeout can re-arm itself via mod_timer() while aggr_reset_state() is running, potentially scheduling a new callback invocation after the struct is freed. The fix, present across all referenced stable commits, replaces timer_delete() with timer_delete_sync() to synchronize callback completion before any memory is released.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel: 6.6.151, 6.12.103, 6.18.42, or 7.1.6 depending on the stable branch in use, or 7.2-rc5 for mainline tracking. Individual fix commits are documented at https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9, https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc, https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1, https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1, and https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc265d. As an interim workaround on systems that do not rely on ath6kl hardware, blacklisting or unloading the module (modprobe -r ath6kl && echo 'blacklist ath6kl' >> /etc/modprobe.d/blacklist.conf) eliminates the attack surface entirely with no functional impact on systems not using Atheros AR600x SDIO/USB devices. Systems actively using ath6kl hardware must prioritize kernel upgrade; no safe functional workaround exists for those deployments.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55299 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy