CVE-2026-68191

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath12k: fix NULL pointer dereference in rhash table destroy<br /> <br /> When unbinding the ath12k driver, kernel NULL pointer dereferences<br /> occur in irq_work_sync() called from rhashtable_destroy().<br /> <br /> Two hash tables are affected:<br /> 1. ath12k_link_sta hash table in ath12k_base<br /> 2. ath12k_dp_link_peer hash table in ath12k_dp<br /> <br /> The issue happens because the destroy functions are called unconditionally<br /> in cleanup paths, but the hash tables are only initialized late in their<br /> respective init functions. If the device was never fully started or if the<br /> init functions failed before initializing the hash tables, the pointers<br /> will be NULL. The issues are always reproducible from a VM because the MSI<br /> addressing initialization is failing.<br /> <br /> Call trace for ath12k_link_sta_rhash_tbl_destroy:<br /> RIP: irq_work_sync+0x1e/0x70<br /> rhashtable_destroy+0x12/0x60<br /> ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]<br /> ath12k_core_stop+0xe/0x80 [ath12k]<br /> ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]<br /> ath12k_pci_remove+0x60/0x110 [ath12k]<br /> <br /> Call trace for ath12k_dp_link_peer_rhash_tbl_destroy:<br /> RIP: irq_work_sync+0x1e/0x70<br /> rhashtable_destroy+0x12/0x60<br /> ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]<br /> ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]<br /> ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]<br /> ath12k_pci_remove+0x60/0x110 [ath12k]<br /> <br /> Fix this by adding NULL checks before calling rhashtable_destroy() in<br /> both destroy functions.<br /> <br /> The NULL check approach was chosen because the rhashtable pointer<br /> serves as the initialization state indicator. The init can fail at<br /> various points, leaving some components uninitialized. Checking the<br /> pointer directly is simpler than adding separate state flags that<br /> would need synchronization.