CVE-2026-68363 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completion context, and then still dereferences hif_dev:
dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n", hif_dev->fw_name);
The re-armed callback ath9k_hif_usb_firmware_cb() runs on the "events" workqueue and, when the firmware is missing, walks the retry chain into ath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That releases the wait_for_completion(&hif_dev->fw_done) in a concurrent ath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing dev_info() in the frame that re-armed the request can therefore read freed memory (hif_dev->udev, the first field of struct hif_device_usb):
BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware Read of size 8 ... by task kworker/... ath9k_hif_request_firmware ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247 request_firmware_work_func Allocated by ...: ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c Freed by ...: ath9k_hif_usb_disconnect -> kfree drivers/net/wireless/ath/ath9k/hif_usb.c
The fw_done barrier only makes disconnect wait for the firmware chain to *terminate*; it does not protect the outer ath9k_hif_request_firmware() frame that re-armed the request and keeps touching hif_dev afterwards.
Drop the post-request dev_info(): it is the only use of hif_dev after the async request is armed, and it is purely informational (the dev_err() on the failure path runs only when request_firmware_nowait() did not arm a callback, so hif_dev is still alive there).
This was first reported by syzbot as a single, non-reproduced crash that was later auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer, which produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc device whose firmware download fails). The vulnerable code is unchanged and still present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN once the (sub-microsecond) race window is widened.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within the linux kernel's ath9k wireless driver, specifically in the hif_usb subsystem where firmware loading operations are handled. This flaw represents a use-after-free condition that occurs during asynchronous firmware request processing, creating a potential security risk through memory corruption. The issue stems from improper handling of device context structures during concurrent firmware loading and disconnection operations, leading to potential exploitation by malicious actors.
The technical implementation flaw involves the function ath9k_hif_request_firmware() which re-arms an asynchronous firmware load operation using request_firmware_nowait(). During this process, it passes hif_dev as the completion context parameter before continuing to dereference the same hif_dev structure. The callback function ath9k_hif_usb_firmware_cb() executes on the events workqueue and when firmware loading fails, it traverses a retry chain that eventually calls ath9k_hif_usb_firmware_fail(), which then invokes complete_all(&hif_dev->fw_done). This completion signal allows concurrent execution in ath9k_hif_usb_disconnect() to proceed, ultimately resulting in kfree() being called on hif_dev. The subsequent dev_info() call in the original function attempts to access freed memory, specifically hif_dev->udev which represents the first field of struct hif_device_usb.
This vulnerability directly maps to CWE-416, Use After Free, and aligns with ATT&CK technique T1059.007 for privilege escalation through kernel memory corruption. The race condition occurs when the firmware loading process completes asynchronously while a disconnect operation is simultaneously occurring, creating a window where memory deallocation and access can happen concurrently without proper synchronization mechanisms.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation attacks against systems running affected kernel versions. An attacker could exploit this condition to corrupt kernel memory structures, leading to system instability, denial of service, or even arbitrary code execution in kernel space. The vulnerability affects devices using ath9k_htc wireless USB adapters and demonstrates the complexity of managing concurrent asynchronous operations in kernel drivers.
Mitigation strategies should focus on removing the post-request dev_info() call since it was the only remaining reference to hif_dev after the asynchronous request was initiated, making it purely informational. This approach eliminates the use-after-free condition by ensuring no references remain to the structure once the async operation begins. Additionally, implementing proper synchronization mechanisms or using reference counting for device contexts during concurrent operations would prevent similar issues in other kernel subsystems. The fix aligns with best practices for asynchronous programming in kernel space where resources must be properly managed through their entire lifecycle.
The vulnerability was initially reported by syzbot as a non-reproduced crash that later became obsolete, but was independently rediscovered by the reFuzz fuzzer which provided a concrete reproducer demonstrating USB gadget connect/disconnect scenarios with failed firmware downloads. This demonstrates how modern fuzzing tools can effectively identify subtle race conditions in kernel code that may not be apparent through traditional testing methods, highlighting the importance of comprehensive testing for concurrent operations in kernel drivers and the need for proper memory management practices during asynchronous operations.