CVE-2026-68362

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the ath11k hal srng access begin() function. The issue occurs because ATH11K FLAG REGISTERED is set unconditionally during ATH11K QMI EVENT FW READY, even if ath11k core qmi firmware ready() fails. This creates an inconsistent state where the driver assumes initialization is complete. During a subsequent Subsystem System Restart (SSR), the driver follows a restart path that dereferences uninitialized srng members, leading to the crash.

Recommendations As a temporary mitigation, restrict the use of the ath11k wireless driver until the system is updated. Update the Linux kernel to a version where the ath11k hal srng access begin() function is patched to ensure ATH11K FLAG REGISTERED is only set upon successful firmware readiness and that ATH11K FLAG QMI FAIL is set on error.