CVE-2026-68362
- Source
- https://cve.org/CVERecord?id=CVE-2026-68362
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68362.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-68362
- Downstream
- Published
- 2026-08-10T12:03:39.363Z
- Modified
- 2026-08-12T04:19:22.644725476Z
- Summary
- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin
In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready() fails. This leaves the driver in an inconsistent state where initialization is considered complete although the firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a NULL pointer dereference.
Call trace: ath11khalsrngaccessbegin+0xc/0x60 [ath11k] (P) ath11kcecleanuppipes+0x17c/0x180 [ath11k] ath11kcore_restart+0x40/0x168 [ath11k]
Fix this by: - skipping firmwareready if ATH11KFLAGREGISTERED is already set - setting ATH11KFLAGREGISTERED only when firmwareready succeeds - setting ATH11KFLAGQMIFAIL and aborting the FWREADY handling on error
Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68362.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/4abb4e284d8897176e91d7a3168ee29ed876bb41
- https://git.kernel.org/stable/c/d6bba659ac30d862ee7bab92862cd6e514f07521
- https://git.kernel.org/stable/c/e517e207300edcf7f3a8f6c45f9155c0e419ffb9
- https://git.kernel.org/stable/c/e5394605f9a985cc3a8263e610ba84b33cbe7b0c
- https://git.kernel.org/stable/c/e8d85672dd7e2523f774caafba8f858384e18df7
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68362.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-68362
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6fe62a8cec51c756159c71be35a16b2cc8cbd4c0Fixede517e207300edcf7f3a8f6c45f9155c0e419ffb9Fixedd6bba659ac30d862ee7bab92862cd6e514f07521Fixede5394605f9a985cc3a8263e610ba84b33cbe7b0cFixed4abb4e284d8897176e91d7a3168ee29ed876bb41Fixede8d85672dd7e2523f774caafba8f858384e18df7