CVE-2026-68363— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于ath9k_hif_request_firmware函数在重新请求固件后仍解引用hif_dev指针，可能导致释放后重用。
可能的 ATT&CK 技术 1 AI
T1203 · Exploitation for Client Execution影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | e904cf6fe23022cde4e0ea9d41601411a315a3dc< 47ed81aaa7f94d9808f4719e78a760c2ec1e6c86 |
affected |
e904cf6fe23022cde4e0ea9d41601411a315a3dc< 48de0c6952192b0771fca468df4364d11ec74ad9 |
affected | ||
e904cf6fe23022cde4e0ea9d41601411a315a3dc< 063497cc9f320ab71a7a937c3bc0a23e630aefe2 |
affected | ||
e904cf6fe23022cde4e0ea9d41601411a315a3dc< 7f184ca38a90889f3f6665ff96748b95da39dbee |
affected | ||
e904cf6fe23022cde4e0ea9d41601411a315a3dc< 10b0ce629123a3737b4eda50188f73bb7be7b68b |
affected | ||
e904cf6fe23022cde4e0ea9d41601411a315a3dc< 48a69cedde7388294e4ea6fd804156cd62bc04fc |
affected | ||
e904cf6fe23022cde4e0ea9d41601411a315a3dc< 7c9046d92c4b9789c9d9d775e4fd5f34be64cb0a |
affected | ||
e904cf6fe23022cde4e0ea9d41601411a315a3dc< dad9f96945d77ecd4708f730c06ef54dcd8cc057 |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-68363 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
ath9k_hif_request_firmware() re-arms an asynchronous firmware load via
request_firmware_nowait(), passing hif_dev as the completion context, and
then still dereferences hif_dev:
dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n",
hif_dev->fw_name);
The re-armed callback ath9k_hif_usb_firmware_cb() runs on the "events"
workqueue and, when the firmware is missing, walks the retry chain into
ath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That
releases the wait_for_completion(&hif_dev->fw_done) in a concurrent
ath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing
dev_info() in the frame that re-armed the request can therefore read freed
memory (hif_dev->udev, the first field of struct hif_device_usb):
BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware
Read of size 8 ... by task kworker/...
ath9k_hif_request_firmware
ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247
request_firmware_work_func
Allocated by ...:
ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c
Freed by ...:
ath9k_hif_usb_disconnect -> kfree drivers/net/wireless/ath/ath9k/hif_usb.c
The fw_done barrier only makes disconnect wait for the firmware chain to
*terminate*; it does not protect the outer ath9k_hif_request_firmware()
frame that re-armed the request and keeps touching hif_dev afterwards.
Drop the post-request dev_info(): it is the only use of hif_dev after the
async request is armed, and it is purely informational (the dev_err() on the
failure path runs only when request_firmware_nowait() did not arm a callback,
so hif_dev is still alive there).
This was first reported by syzbot as a single, non-reproduced crash that was
later auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer,
which produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc
device whose firmware download fails). The vulnerable code is unchanged and
still present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN
once the (sub-microsecond) race window is widened.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于ath9k_hif_request_firmware函数在重新请求固件后仍解引用hif_dev指针，可能导致释放后重用。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-68363 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-68363 的情报信息
请登录查看更多情报信息。
CVE-2026-68363 补丁与修复 (6)
同批安全公告 · Linux · 2026-08-10 · 共 344 条
| CVE-2026-68117 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68161 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68160 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68123 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68302 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68381 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68385 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68159 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68127 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68388 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68144 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68137 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68136 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68170 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68426 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68156 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68158 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68300 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68154 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-68124 | 9.6 CRITICAL | Linux kernel 安全漏洞 |
显示前 20 条，共 344 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-68363
暂无评论