https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 20:16:30 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68198 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: ath6kl: fix use-after-free in aggr_reset_state()</p> <p>The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy().</p> <p>If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info-&gt;aggr_conn) in aggr_module_destroy().</p> <p>Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition.</p> <p>Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: ath6kl: fix use-after-free in aggr_reset_state()</p> <p>The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy().</p> <p>If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info-&gt;aggr_conn) in aggr_module_destroy().</p> <p>Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition.</p> <p>Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.</p> https://vulnerability.circl.lu/vuln/cve-2026-68198