CVE-2026-68363

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc6

Description A slab-use-after-free issue exists in the ath9k hif request firmware() function. The function re-arms an asynchronous firmware load using request firmware nowait(), passing hif dev as the completion context, but continues to dereference hif dev in a subsequent dev info() call. A race condition occurs when the callback ath9k hif usb firmware cb() triggers ath9k hif usb firmware fail(), which calls complete all(&hif dev->fw done). This allows a concurrent ath9k hif usb disconnect() process to execute kfree() on hif dev. Consequently, the trailing dev info() call may read freed memory from the hif dev->udev field. This was identified through crashes reported by syzbot and the reFuzz fuzzer during USB-gadget connect/disconnect cycles where firmware downloads failed.

Recommendations Update the Linux kernel to a version where the post-request dev info() call in ath9k hif request firmware() has been removed.