CVE-2026-68363: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68363 Overview

CVE-2026-68363 is a use-after-free vulnerability in the Linux kernel's ath9k USB Wi-Fi driver (ath9k_htc). The flaw resides in ath9k_hif_request_firmware() within drivers/net/wireless/ath/ath9k/hif_usb.c. After re-arming an asynchronous firmware load via request_firmware_nowait(), the function continues to dereference the hif_dev pointer in a trailing dev_info() call. A concurrent ath9k_hif_usb_disconnect() can free hif_dev before that access completes, producing a slab-use-after-free detectable under KASAN.

Critical Impact
A malicious or malfunctioning USB device that induces firmware download failures can trigger kernel memory corruption, leading to potential denial of service or exploitation for privilege escalation.

Affected Products

Linux kernel ath9k_htc driver (USB variant of ath9k)
Confirmed present in Linux kernel through v7.1-rc6
Systems using Atheros AR9271 and related USB Wi-Fi adapters

Discovery Timeline

2026-08-10 - CVE-2026-68363 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68363

Vulnerability Analysis

The defect is a classic race between an asynchronous callback chain and a concurrent teardown path. ath9k_hif_request_firmware() calls request_firmware_nowait() with hif_dev as the completion context. That call arms ath9k_hif_usb_firmware_cb() on the kernel events workqueue. When firmware retrieval fails, the callback walks into ath9k_hif_usb_firmware_fail() and issues complete_all(&hif_dev->fw_done).

That completion releases a concurrently waiting ath9k_hif_usb_disconnect(), which then calls kfree(hif_dev). The re-arming frame, however, still executes a trailing dev_info(&hif_dev->udev->dev, ...) after request_firmware_nowait() returns. This read touches hif_dev->udev — the first field of struct hif_device_usb — after the object has been freed.

The fw_done completion barrier only guarantees that the firmware chain has terminated; it does not protect the outer stack frame that already re-armed the request. The race window is sub-microsecond but reliably widened under KASAN instrumentation. The vulnerability class is Use After Free ([CWE-416]).

Root Cause

The root cause is a lifetime management error. Once request_firmware_nowait() succeeds in arming the asynchronous callback, ownership of hif_dev effectively transitions to the callback chain plus any disconnect path waiting on fw_done. The caller retains no valid reference. The trailing informational dev_info() violates that ownership contract by dereferencing hif_dev after transfer.

Attack Vector

The vulnerability is reachable via USB. A USB-gadget device advertising itself as an ath9k_htc adapter can trigger the condition by presenting a probe-then-disconnect sequence where firmware download fails. A public C reproducer was produced by the reFuzz fuzzer, executing USB-gadget connect/disconnect cycles against an ath9k_htc device whose firmware download fails. Physical access or a compromised USB peripheral (including malicious BadUSB-style devices) is required.

The vulnerability manifests when a workqueue-scheduled firmware callback races with driver disconnect. See the kernel commit fixing the issue for the corrective patch, which removes the trailing dev_info() call so that no dereference of hif_dev occurs after the asynchronous request is armed.

Detection Methods for CVE-2026-68363

Indicators of Compromise

KASAN reports in dmesg citing slab-use-after-free in ath9k_hif_request_firmware with read of size 8
Kernel oops or panic traces referencing ath9k_hif_usb_firmware_cb and request_firmware_work_func
Unexpected USB device attach/detach cycles for Atheros 0cf3: or 13b1: vendor/product IDs coinciding with driver crashes

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free deterministically before production deployment
Monitor kernel ring buffer for ath9k_htc driver faults and firmware load failures via centralized log collection
Correlate USB device enumeration events with subsequent kernel warnings to identify targeted exploitation attempts

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into a centralized SIEM for pattern matching on ath9k crash signatures
Alert on repeated USB attach/detach events from Wi-Fi class devices on servers or endpoints where such devices are not expected
Track kernel version inventory across the fleet to prioritize patch rollout on hosts running vulnerable builds through v7.1-rc6

How to Mitigate CVE-2026-68363

Immediate Actions Required

Apply the upstream kernel fix from the stable tree that removes the trailing dev_info() dereference in ath9k_hif_request_firmware()
Rebuild and deploy kernels incorporating the patch to all systems using the ath9k_htc USB driver
Restrict physical USB access on high-value systems and disable unused USB Wi-Fi adapters until patched

Patch Information

The fix has been merged into the mainline and stable kernel trees. Relevant commits include 10b0ce629, 48a69cedd, 7c9046d92, 7f184ca38, and dad9f9694. The patch drops the post-request dev_info() because it is the only remaining use of hif_dev after the asynchronous request is armed and is purely informational.

Workarounds

Blacklist the ath9k_htc kernel module on systems that do not require USB Wi-Fi functionality using modprobe.d configuration
Enforce USB device authorization policies via udev rules or USBGuard to prevent unauthorized ath9k_htc devices from binding
Deploy endpoint controls to restrict USB peripheral classes on servers and workstations handling sensitive workloads

bash

# Blacklist the vulnerable driver until patched kernels are deployed
echo 'blacklist ath9k_htc' | sudo tee /etc/modprobe.d/blacklist-ath9k_htc.conf
sudo rmmod ath9k_htc 2>/dev/null || true
sudo update-initramfs -u