CVE-2026-68198

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath6kl: fix use-after-free in aggr_reset_state()<br /> <br /> The aggr_reset_state() function uses timer_delete() (non-synchronous)<br /> for the aggregation timer before proceeding to delete TID state and<br /> before the structure is freed by callers like aggr_module_destroy().<br /> <br /> If the timer callback (aggr_timeout) is executing when aggr_reset_state()<br /> is called, the callback will continue to access aggr_conn fields like<br /> rx_tid[] and stat[] which may be freed immediately after by<br /> kfree(aggr_info-&gt;aggr_conn) in aggr_module_destroy().<br /> <br /> Additionally, the timer callback can re-arm itself via mod_timer() while<br /> aggr_reset_state() is running, creating a more complex race condition.<br /> <br /> Use timer_delete_sync() instead to ensure any running timer callback<br /> has completed before returning.