CVE-2026-68191

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix NULL pointer dereference in rhash table destroy

When unbinding the ath12k driver, kernel NULL pointer dereferences

occur in irq_work_sync() called from rhashtable_destroy().

Two hash tables are affected:

1. ath12k_link_sta hash table in ath12k_base

2. ath12k_dp_link_peer hash table in ath12k_dp

The issue happens because the destroy functions are called unconditionally

in cleanup paths, but the hash tables are only initialized late in their

respective init functions. If the device was never fully started or if the

init functions failed before initializing the hash tables, the pointers

will be NULL. The issues are always reproducible from a VM because the MSI

addressing initialization is failing.

Call trace for ath12k_link_sta_rhash_tbl_destroy:

RIP: irq_work_sync+0x1e/0x70

rhashtable_destroy+0x12/0x60

ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]

ath12k_core_stop+0xe/0x80 [ath12k]

ath1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References