Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-74407

wifi: ath11k: cancel SSR work items during PCI shutdown

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts. Simplified trace: dma_free_attrs mhi_deinit_dev_ctxt [mhi] ath11k_pci_power_down [ath11k_pci] ath11k_pci_shutdown [ath11k_pci] device_shutdown kernel_restart On the host side, SSR is driven by the MHI RDDM callback, which queues reset_work to perform device recovery. reset_work power-cycles the device by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The power-down phase deinitializes MHI and frees DMA resources. Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR recovery flow. As a result, the shutdown path (ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR recovery sequence. Fix this by canceling SSR-related work items during PCI shutdown, marking the device as unregistering, and serializing the RDDM callback path that checks and queues reset_work. This ensures that no new SSR recovery work can be queued once teardown has started, and that any in-flight recovery work is fully synchronized before device power-down, preventing MHI teardown and DMA resource freeing from running more than once. Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k devices do not queue reset_work in normal SSR flows. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 13da397f884d9c9a3fb6616206eeb6c6ab097287 to < 7630eb217166435e8a6dd501fa4ad304e2264407affected
  • 13da397f884d9c9a3fb6616206eeb6c6ab097287 to < f82d42577ee4a191b0ad0f0a3b49fc1935dff845affected
  • 13da397f884d9c9a3fb6616206eeb6c6ab097287 to < daeb44fb8d700654f37f54d1ee36cd67645d0d34affected
  • 13da397f884d9c9a3fb6616206eeb6c6ab097287 to < 6dd3701facc0cee62d6682e49eed64499f9d0e43affected
  • 13da397f884d9c9a3fb6616206eeb6c6ab097287 to < 53dd29e8aeb2a1b5f079178551836b85fc6b53dfaffected
  • 13da397f884d9c9a3fb6616206eeb6c6ab097287 to < 8c79aac429b583301f387374ff37c59be671df87affected

Linux Linux

Default version status: affected

  • 5.19affected
  • 0 to < 5.19unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References