CVE-2026-63822 - Vulnerability Details

- wifi: ath11k: fix warning when unbinding

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix warning when unbinding

If there is an error during some initialization related to firmware,
the buffers dp->tx_ring[i].tx_status are released.
However this is released again when the device is unbinded (ath11k_pci),
and we get:
WARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90
Call Trace:
free_large_kmalloc
ath11k_dp_free
ath11k_core_deinit
ath11k_pci_remove
...

The issue is always reproducible from a VM because the MSI addressing
initialization is failing.

In order to fix the issue, just set the buffers to NULL after releasing in
order to avoid the double free.

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ath11k wireless driver releases tx_status buffers during a firmware initialization failure and releases them again upon device removal. This double free triggers a SLUB allocator warning in the kernel logs and may lead to undefined kernel behavior, but no crash is confirmed in the provided description.

Affected Systems

All Linux kernel releases that include the ath11k driver prior to the patch that nulls buffer pointers after release are affected. The issue exists in vendor builds of the kernel containing the unpatched ath11k code.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate risk. The EPSS score of less than 1% suggests a very low probability of exploitation. Exploitation requires a firmware initialization failure that can be induced locally or via kernel-level access, so the attack vector is likely local. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d5c65159f2895379e11ca13f62feabe93278985d`	affected	< e569a5cb401a267168621aa9a1e7f07fcc9612c3
`d5c65159f2895379e11ca13f62feabe93278985d`	affected	< 0aa097a370277deab5337030b9e2d395742f469c
`d5c65159f2895379e11ca13f62feabe93278985d`	affected	< 0a946abb82f29abe9a15173b707a449cb039b43e
`d5c65159f2895379e11ca13f62feabe93278985d`	affected	< 318703b6f71d1a29ee0ac46c32a38f7734d4cfb2
`d5c65159f2895379e11ca13f62feabe93278985d`	affected	< 7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13
`d5c65159f2895379e11ca13f62feabe93278985d`	affected	< 40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0a
`d5c65159f2895379e11ca13f62feabe93278985d`	affected	< 051f954b94479d72222c9fbc82a3eef4777bca01
`d5c65159f2895379e11ca13f62feabe93278985d`	affected	< 8b7a26b6681922a38cd5a7829ace61f8e54df9b7

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d5c65159f2895379e11ca13f62feabe93278985d,e569a5cb401a267168621aa9a1e7f07fcc9612c3)`	affected	code_commit	—
`[d5c65159f2895379e11ca13f62feabe93278985d,0aa097a370277deab5337030b9e2d395742f469c)`	affected	code_commit	—
`[d5c65159f2895379e11ca13f62feabe93278985d,0a946abb82f29abe9a15173b707a449cb039b43e)`	affected	code_commit	—
`[d5c65159f2895379e11ca13f62feabe93278985d,318703b6f71d1a29ee0ac46c32a38f7734d4cfb2)`	affected	code_commit	—
`[d5c65159f2895379e11ca13f62feabe93278985d,7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13)`	affected	code_commit	—
`[d5c65159f2895379e11ca13f62feabe93278985d,40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0a)`	affected	code_commit	—
`[d5c65159f2895379e11ca13f62feabe93278985d,051f954b94479d72222c9fbc82a3eef4777bca01)`	affected	code_commit	—
`[d5c65159f2895379e11ca13f62feabe93278985d,8b7a26b6681922a38cd5a7829ace61f8e54df9b7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	semver	—
`[5.10.260,5.11.0)`	unaffected	semver	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that contains the patched ath11k driver where buffer pointers are cleared after release.
If an upgrade is not immediately possible, blacklist or unload the ath11k module to prevent the double free during device removal.
Monitor kernel logs for SLUB allocator warnings, enable crash dump mechanisms, and review vmcore files for evidence of unexpected kernel crashes.

Generated by OpenCVE AI on August 3, 2026 at 02:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00174.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/051f954b94479d72222c9fbc82a3eef4777bca01
https://git.kernel.org/stable/c/0a946abb82f29abe9a15173b707a449cb039b43e
https://git.kernel.org/stable/c/0aa097a370277deab5337030b9e2d395742f469c
https://git.kernel.org/stable/c/318703b6f71d1a29ee0ac46c32a38f7734d4cfb2
https://git.kernel.org/stable/c/40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0a
https://git.kernel.org/stable/c/7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13
https://git.kernel.org/stable/c/8b7a26b6681922a38cd5a7829ace61f8e54df9b7
https://git.kernel.org/stable/c/e569a5cb401a267168621aa9a1e7f07fcc9612c3
https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-63822-fdd2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63822
https://www.cve.org/CVERecord?id=CVE-2026-63822

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-63822-fdd2@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63822 https://www.cve.org/CVERecord?id=CVE-2026-63822
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is unbinded (ath11k_pci), and we get: WARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90 Call Trace: free_large_kmalloc ath11k_dp_free ath11k_core_deinit ath11k_pci_remove ... The issue is always reproducible from a VM because the MSI addressing initialization is failing. In order to fix the issue, just set the buffers to NULL after releasing in order to avoid the double free.
Title		wifi: ath11k: fix warning when unbinding
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/051f954b94479d72222c9fbc82a3eef4777bca01 https://git.kernel.org/stable/c/0a946abb82f29abe9a15173b707a449cb039b43e https://git.kernel.org/stable/c/0aa097a370277deab5337030b9e2d395742f469c https://git.kernel.org/stable/c/318703b6f71d1a29ee0ac46c32a38f7734d4cfb2 https://git.kernel.org/stable/c/40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0a https://git.kernel.org/stable/c/7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13 https://git.kernel.org/stable/c/8b7a26b6681922a38cd5a7829ace61f8e54df9b7 https://git.kernel.org/stable/c/e569a5cb401a267168621aa9a1e7f07fcc9612c3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:19.286Z

Updated: 2026-07-19T12:02:19.286Z

Reserved: 2026-07-19T07:54:57.014Z

Link: CVE-2026-63822

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63822 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T02:45:03Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object