CVE-2026-68191

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the irq work sync() function, which is called by rhashtable destroy(), when unbinding the ath12k driver. This issue affects the ath12k link sta hash table in ath12k base and the ath12k dp link peer hash table in ath12k dp. The problem arises because destroy functions are called unconditionally during cleanup paths, even if the hash tables were never initialized due to a failure in the initialization functions or if the device never fully started. This behavior is consistently reproducible in virtual machine environments where MSI addressing initialization fails.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.