CVE-2026-68198

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the aggr reset state() function within the ath6kl wifi driver. The function employs a non-synchronous timer delete() for the aggregation timer before deleting the TID state and freeing the structure via aggr module destroy(). If the aggr timeout() timer callback is executing during this process, it may continue to access aggr conn fields, such as rx tid[] and stat[], after they have been freed by kfree(aggr info->aggr conn). Furthermore, a race condition can occur if the timer callback re-arms itself using mod timer() while aggr reset state() is active.

Recommendations Replace the use of timer delete() with timer delete sync() in the aggr reset state() function to ensure any active timer callback completes before the structure is freed.