{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-68191",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-68191",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-10T12:00:09.069Z",
    "updatedAt": "2026-08-17T05:00:33.856Z",
    "importedAt": "2026-10-24T01:58:25.636Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "wifi: ath12k: fix NULL pointer dereference in rhash table destroy",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix NULL pointer dereference in rhash table destroy\n\nWhen unbinding the ath12k driver, kernel NULL pointer dereferences\noccur in irq_work_sync() called from rhashtable_destroy().\n\nTwo hash tables are affected:\n1. ath12k_link_sta hash table in ath12k_base\n2. ath12k_dp_link_peer hash table in ath12k_dp\n\nThe issue happens because the destroy functions are called unconditionally\nin cleanup paths, but the hash tables are only initialized late in their\nrespective init functions. If the device was never fully started or if the\ninit functions failed before initializing the hash tables, the pointers\nwill be NULL. The issues are always reproducible from a VM because the MSI\naddressing initialization is failing.\n\nCall trace for ath12k_link_sta_rhash_tbl_destroy:\n RIP: irq_work_sync+0x1e/0x70\n rhashtable_destroy+0x12/0x60\n ath12k_link_sta_rhash_tbl_destroy+0x19/0x40 [ath12k]\n ath12k_core_stop+0xe/0x80 [ath12k]\n ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]\n ath12k_pci_remove+0x60/0x110 [ath12k]\n\nCall trace for ath12k_dp_link_peer_rhash_tbl_destroy:\n RIP: irq_work_sync+0x1e/0x70\n rhashtable_destroy+0x12/0x60\n ath12k_dp_link_peer_rhash_tbl_destroy+0x29/0x50 [ath12k]\n ath12k_dp_cmn_device_deinit+0x21/0x140 [ath12k]\n ath12k_core_hw_group_cleanup+0x6b/0xb0 [ath12k]\n ath12k_pci_remove+0x60/0x110 [ath12k]\n\nFix this by adding NULL checks before calling rhashtable_destroy() in\nboth destroy functions.\n\nThe NULL check approach was chosen because the rhashtable pointer\nserves as the initialization state indicator. The init can fail at\nvarious points, leaving some components uninitialized. Checking the\npointer directly is simpler than adding separate state flags that\nwould need synchronization.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "57ccca410237285f8f25a988655e6910cadc63f2",
              "status": "affected",
              "versionType": "git",
              "lessThan": "17a4298f7794843af0094035723dc5e7311c7453"
            },
            {
              "version": "57ccca410237285f8f25a988655e6910cadc63f2",
              "status": "affected",
              "versionType": "git",
              "lessThan": "70231dcd782201579990ded73e0435d18bb524ca"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "7.0",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "7.0"
            },
            {
              "version": "7.1.6",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "version": "7.2",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}