CVE-2026-68191

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. When the ath12k driver is unbound, a NULL pointer dereference can occur in the rhash table destroy functions. This issue arises because the hash tables may not be fully initialized before their destroy functions are called unconditionally during cleanup. An attacker could potentially trigger this condition, leading to a kernel NULL pointer dereference and a system crash, resulting in a denial of service.

This issue affects systems using Qualcomm ath12k Wi-Fi hardware. Unbinding the driver can NULL-deref in rhashtable_destroy() for link_sta and dp hash tables. Systems without ath12k hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ath12k module from loading. See https://access.redhat.com/solutions/41278 for instructions.