CVE-2026-68191: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68191 Overview

CVE-2026-68191 is a NULL pointer dereference vulnerability in the Linux kernel ath12k Wi-Fi driver. The flaw occurs when unbinding the driver, where irq_work_sync() is called from rhashtable_destroy() on uninitialized hash tables. Two hash tables are affected: the ath12k_link_sta table in ath12k_base and the ath12k_dp_link_peer table in ath12k_dp. The destroy functions run unconditionally during cleanup, but the hash tables are initialized late in device startup. If initialization fails before those tables are created, the pointers remain NULL and the driver crashes on unbind.

Critical Impact
Local kernel crash on driver unbind when ath12k initialization does not complete, resulting in denial of service on systems with Qualcomm Wi-Fi 7 hardware or virtualized environments where MSI addressing setup fails.

Affected Products

Linux kernel ath12k wireless driver (Qualcomm Wi-Fi 7 devices)
Virtual machines where MSI addressing initialization fails for ath12k
Kernel builds prior to commits 17a4298f7794 and 70231dcd7822

Discovery Timeline

2026-08-10 - CVE-2026-68191 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68191

Vulnerability Analysis

The vulnerability lives in the cleanup path of the ath12k driver. When ath12k_pci_remove() runs, it invokes ath12k_core_hw_group_cleanup(), which in turn calls ath12k_core_stop() and ath12k_dp_cmn_device_deinit(). Both paths reach ath12k_link_sta_rhash_tbl_destroy() and ath12k_dp_link_peer_rhash_tbl_destroy(), which call rhashtable_destroy() without checking whether the underlying hash tables were ever initialized. rhashtable_destroy() then calls irq_work_sync() on an uninitialized irq_work structure, dereferencing a NULL pointer inside the kernel.

The crash is reliably reproducible inside virtual machines because MSI addressing initialization fails there, aborting the init path before the hash tables are created. On bare metal, the same code path is reachable whenever any earlier initialization step fails.

Root Cause

The hash tables serve dual purposes: they hold peer state and act as implicit initialization markers. Because init can fail at several points, the driver reaches its unbind path in a partially initialized state. The destroy routines assume the tables exist and pass uninitialized memory into rhashtable_destroy(), triggering a NULL pointer dereference [CWE-476].

Attack Vector

Exploitation requires local privileges to trigger driver unbind or to induce an init failure such as a probe error on ath12k hardware. A low-privilege user cannot typically unbind a PCI driver, but a system reboot loop, hotplug event, or module reload during a failed init reproduces the crash. The impact is limited to kernel denial of service; no memory corruption or code execution is documented.

The fix, applied in kernel commits 17a4298f7794 and 70231dcd7822, adds NULL checks before each rhashtable_destroy() call in the two affected destroy functions.

Detection Methods for CVE-2026-68191

Indicators of Compromise

Kernel oops or panic messages referencing irq_work_sync+0x1e/0x70 and rhashtable_destroy+0x12/0x60 in dmesg or /var/log/kern.log.
Stack traces containing ath12k_link_sta_rhash_tbl_destroy or ath12k_dp_link_peer_rhash_tbl_destroy frames.
Repeated ath12k probe failures followed by module unload events.

Detection Strategies

Parse kernel logs for the exact symbol sequence rhashtable_destroy → ath12k_*_rhash_tbl_destroy and alert on any match.
Monitor for ath12k MSI initialization errors that precede driver removal, especially in virtualized fleets.
Track kernel version and module inventory to identify hosts running vulnerable ath12k builds.

Monitoring Recommendations

Forward /dev/kmsg and journald kernel facility events to your central log platform for correlation with reboots and crashes.
Alert on unexpected ath12k module load, unload, or probe-failure events on production hosts.
Track kernel package versions across the fleet and flag hosts missing the stable-tree commits referenced in the advisory.

How to Mitigate CVE-2026-68191

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 17a4298f7794 and 70231dcd7822 to all systems running the ath12k driver.
Rebuild and reboot virtual machines where ath12k is present, since MSI init failure makes the crash consistently reproducible there.
Audit kernel logs for prior occurrences of the crash signature to confirm no persistent instability remains after patching.

Patch Information

The fix is available in the Linux stable tree via kernel commit 17a4298f7794 and kernel commit 70231dcd7822. Both commits add NULL checks before rhashtable_destroy() in ath12k_link_sta_rhash_tbl_destroy() and ath12k_dp_link_peer_rhash_tbl_destroy(). Distribution kernels should pick up these commits in their next stable rebase.

Workarounds

Blacklist the ath12k module on systems that do not require Qualcomm Wi-Fi 7 functionality until a patched kernel is deployed.
Avoid unbinding or reloading ath12k on hosts where initialization is known to fail, particularly VMs without proper MSI passthrough.
Restrict local access to accounts that can trigger PCI driver unbind operations through sysfs.

bash

# Blacklist ath12k until a patched kernel is installed
echo "blacklist ath12k" | sudo tee /etc/modprobe.d/blacklist-ath12k.conf
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep ath12k