310 lines
16 KiB
JSON
310 lines
16 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-68198",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-30T09:28:09.374Z",
|
|
"datePublished": "2026-08-10T12:00:16.718Z",
|
|
"dateUpdated": "2026-10-19T18:00:24.933Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-23T12:46:06.548Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info->aggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 8.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:A - ath6kl is a WiFi driver; the race is driven by 802.11 frames from an adjacent attacker — a gapped A-MPDU sequence arms the reorder timer and a deauth/disassoc or connect/disconnect event drives aggr_reset_state() via ath6kl_disconnect_event()/ath6kl_connect_event()/ath6kl_sta_cleanup(). This requires radio proximity, not routable network access.\nAC:L - The attacker controls both sides of the race: transmitting out-of-order aggregated frames arms aggr_conn->timer, and a deauth/disassoc or reconnect immediately invokes aggr_reset_state(), which frees rx_tid[].hold_q and (via aggr_module_destroy) aggr_conn itself while aggr_timeout() may be running or re-arming via mod_timer(). The sequence can be repeated indefinitely until the window is hit.\nPR:N - No privileges or account on the target system are required; a rogue AP the client associates with, or an attacker injecting unprotected deauth/disassoc frames at a station with an active block-ack session, is sufficient. In AP mode, a station joining an open network can trigger the same path on disconnect.\nUI:N - The station already associated and receiving aggregated traffic is enough; deauth/disassoc handling and the resulting aggr_reset_state() run automatically in the driver with no action by the device owner.\nS:U - The use-after-free is on kernel heap memory owned by the ath6kl driver and stays within the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed aggr_info_conn and hold_q allocations can be reclaimed and refilled with attacker-influenced data (e.g. sk_buff payloads from injected frames), so the concurrent callback reading rx_tid[]/stat[]/hold_q[] yields a controllable read primitive that can leak kernel memory contents.\nI:H - aggr_timeout() writes through the freed object — setting timer_scheduled, rxtid->timer_mon, dequeuing skbs from hold_q[] and calling mod_timer() on a freed timer_list — giving arbitrary writes into reclaimed heap objects and list corruption that is a classic path to control-flow hijack.\nA:H - Even without successful heap grooming, the use-after-free and the double-free/dangling-skb access in aggr_deque_frms() reliably produce slab corruption and a kernel oops or panic, and the attacker can repeat the trigger at will."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/wireless/ath/ath6kl/txrx.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
|
|
"lessThan": "a1bac650b2d6b1baab1f3e78e2e007a6e2948dde",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
|
|
"lessThan": "2132a6db05846dd2318857d00e0c1291f9e41b29",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
|
|
"lessThan": "17ff29cd8dbc977c97788a5f7c011ec807b58242",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
|
|
"lessThan": "64af6534a085f49d6ed33338a19ab9cf0d0523c9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
|
|
"lessThan": "b5d618fd61b9069b4c0a6b487022dd3117ad5acc",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
|
|
"lessThan": "18965470d41e69d3fc10eb62afae29d10f4cdfd1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
|
|
"lessThan": "a3313111b5d9046af60b370c93eec105b27380c1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
|
|
"lessThan": "ba7debb4dd6427386862220e8335a53a4bfc235d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/wireless/ath/ath6kl/txrx.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "3.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "3.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.266",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.217",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.184",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.151",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.103",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.42",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.6",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.2",
|
|
"versionEndExcluding": "5.10.266"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.2",
|
|
"versionEndExcluding": "5.15.217"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.2",
|
|
"versionEndExcluding": "6.1.184"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.2",
|
|
"versionEndExcluding": "6.6.151"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.2",
|
|
"versionEndExcluding": "6.12.103"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.2",
|
|
"versionEndExcluding": "6.18.42"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.2",
|
|
"versionEndExcluding": "7.1.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.2",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"
|
|
}
|
|
],
|
|
"title": "wifi: ath6kl: fix use-after-free in aggr_reset_state()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"type": "CWE",
|
|
"cweId": "CWE-416",
|
|
"lang": "en",
|
|
"description": "CWE-416 Use After Free"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-10-16T15:45:39.924585Z",
|
|
"id": "CVE-2026-68198",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-19T18:00:24.933Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |