CVE-2026-68191: wifi: ath12k: fix NULL pointer dereference in rhash table destroy
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix NULL pointer dereference in rhash table destroy
When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync() called from rhashtabledestroy().
Two hash tables are affected: 1. ath12klinksta hash table in ath12kbase 2. ath12kdplinkpeer hash table in ath12kdp
The issue happens because the destroy functions are called unconditionally in cleanup paths, but the hash tables are only initialized late in their respective init functions. If the device was never fully started or if the init functions failed before initializing the hash tables, the pointers will be NULL. The issues are always reproducible from a VM because the MSI addressing initialization is failing.
Call trace for ath12klinkstarhashtbldestroy: RIP: irqworksync+0x1e/0x70 rhashtabledestroy+0x12/0x60 ath12klinkstarhashtbldestroy+0x19/0x40 [ath12k] ath12kcorestop+0xe/0x80 [ath12k] ath12kcorehwgroupcleanup+0x6b/0xb0 [ath12k] ath12kpciremove+0x60/0x110 [ath12k]
Call trace for ath12kdplinkpeerrhashtbldestroy: RIP: irqworksync+0x1e/0x70 rhashtabledestroy+0x12/0x60 ath12kdplinkpeerrhashtbldestroy+0x29/0x50 [ath12k] ath12kdpcmndevicedeinit+0x21/0x140 [ath12k] ath12kcorehwgroupcleanup+0x6b/0xb0 [ath12k] ath12kpciremove+0x60/0x110 [ath12k]
Fix this by adding NULL checks before calling rhashtabledestroy() in both destroy functions.
The NULL check approach was chosen because the rhashtable pointer serves as the initialization state indicator. The init can fail at various points, leaving some components uninitialized. Checking the pointer directly is simpler than adding separate state flags that would need synchronization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In cleanup paths for ath12k, add NULL checks before calling rhashtable_destroy() in both ath12k_dp_link_peer_rhash_tbl_destroy() and ath12k_link_sta_rhash_tbl_destroy(), because the destroy functions are called unconditionally while the rhashtable pointers can remain NULL when initialization fails (e.g., device never fully started).
Linux kernel (ath12k driver) NULL checks before calling rhashtable_destroy() = Add NULL checks
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68191?
CVE-2026-68191 has a risk rating of 27.
What does CVE-2026-68191 affect?
CVE-2026-68191 affects the ath12k driver in the Linux kernel.
How do I fix CVE-2026-68191?
To fix CVE-2026-68191, update your Linux kernel to the latest version where the vulnerability has been patched.
What kind of vulnerability is CVE-2026-68191?
CVE-2026-68191 is classified as a null pointer dereference vulnerability.
What happens if CVE-2026-68191 is exploited?
Exploitation of CVE-2026-68191 can result in kernel crashes due to a null pointer dereference.