CVE-2026-68363

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

ath9k_hif_request_firmware() re-arms an asynchronous firmware load via

request_firmware_nowait(), passing hif_dev as the completion context, and

then still dereferences hif_dev:

dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n",

hif_dev->fw_name);

The re-armed callback ath9k_hif_usb_firmware_cb() runs on the "events"

workqueue and, when the firmware is missing, walks the retry chain into

ath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That

releases the wait_for_completion(&hif_dev->fw_done) in a concurrent

ath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing

dev_info() in the frame that re-armed the request can therefore read freed

memory (hif_dev->udev, the first field of struct hif_device_usb):

BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware

Read of size 8 ...

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References