CVE-2026-68362: wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin
In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready() fails. This leaves the driver in an inconsistent state where initialization is considered complete although the firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a NULL pointer dereference.
Call trace: ath11khalsrngaccessbegin+0xc/0x60 [ath11k] (P) ath11kcecleanuppipes+0x17c/0x180 [ath11k] ath11kcorerestart+0x40/0x168 [ath11k]
Fix this by: - skipping firmwareready if ATH11KFLAGREGISTERED is already set - setting ATH11KFLAGREGISTERED only when firmwareready succeeds - setting ATH11KFLAGQMIFAIL and aborting the FWREADY handling on error
Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ath11k (Linux kernel driver)to a version that resolves this vulnerability.Patch WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1 - Configuration
In ATH11K_QMI_EVENT_FW_READY, when ATH11K_FLAG_QMI_FAIL is set, abort the FW_READY handling.
ath11k ATH11K_FLAG_QMI_FAIL = aborting FW_READY handling - Configuration
In ATH11K_QMI_EVENT_FW_READY, set ATH11K_FLAG_REGISTERED only after ath11k_core_qmi_firmware_ready() succeeds.
ath11k ATH11K_FLAG_REGISTERED = set only when firmware_ready succeeds - Configuration
In ATH11K_QMI_EVENT_FW_READY, skip/avoid calling firmware_ready if ATH11K_FLAG_REGISTERED is already set (to prevent inconsistent restart path behavior).
ath11k firmware_ready execution = skip if ATH11K_FLAG_REGISTERED already set
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68362?
CVE-2026-68362 has a risk rating of 27, indicating it is a relatively low-severity vulnerability.
How do I fix CVE-2026-68362?
To fix CVE-2026-68362, update the Linux kernel to a version where the NULL pointer dereference issue has been resolved.
What impact does CVE-2026-68362 have on systems?
CVE-2026-68362 may result in a system crash or instability due to a NULL pointer dereference in the ath11k driver.
Which versions of the Linux kernel are affected by CVE-2026-68362?
CVE-2026-68362 affects specific versions of the Linux kernel that include the ath11k driver prior to the fix.
What components are involved in CVE-2026-68362?
CVE-2026-68362 primarily involves the ath11k wireless driver and its interaction with QMI events in the Linux kernel.