Description
In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: cancel SSR work items during PCI shutdown

A reboot can crash the kernel if it overlaps with WLAN firmware crash
recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown
path while freeing DMA-backed MHI contexts.

Simplified trace:
dma_free_attrs
mhi_deinit_dev_ctxt [mhi]
ath11k_pci_power_down [ath11k_pci]
ath11k_pci_shutdown [ath11k_pci]
device_shutdown
kernel_restart

On the host side, SSR is driven by the MHI RDDM callback, which queues
reset_work to perform device recovery. reset_work power-cycles the device
by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The
power-down phase deinitializes MHI and frees DMA resources.

Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR
recovery flow. As a result, the shutdown path
(ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR
recovery sequence.

Fix this by canceling SSR-related work items during PCI shutdown, marking
the device as unregistering, and serializing the RDDM callback path that
checks and queues reset_work. This ensures that no new SSR recovery work
can be queued once teardown has started, and that any in-flight recovery
work is fully synchronized before device power-down, preventing MHI
teardown and DMA resource freeing from running more than once.

Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k
devices do not queue reset_work in normal SSR flows.

Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
Published: 2026-08-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in the ath11k wireless driver causes a null pointer dereference in the MHI teardown path while freeing DMA resources, which can bring the entire kernel down during a reboot. This results in a system crash and denial of service as the operating system must be rebooted to recover. The weakness is a classic null pointer dereference exacerbated by a race condition between device shutdown and firmware recovery.

Affected Systems

The issue targets Linux kernel devices that use the ath11k driver on PCI/MHI‑based hardware, such as the WCN6855 hardware revision 2.1 used in WLAN.HSP.1.1 devices. AHB‑based ath11k devices are unaffected and do not queue reset work during SSR flows.

Risk and Exploitability

The risk is significant because a kernel crash leads to system halt until a reboot, and a CVSS score of 8.8 highlights a high severity denial‑of‑service. The EPSS score of < 1% indicates a low exploitation probability, and the lack of a CISA KEV listing suggests it is not yet widely exploited. Nonetheless the potential impact warrants rapid remediation.

Generated by OpenCVE AI on August 17, 2026 at 14:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Linux kernel that includes the ath11k SSR work item cancellation patch
  • Temporarily disable the Wi‑Fi subsystem or block SDK power‑down during pending shutdowns to avoid race with SSR recovery
  • Verify that the device is not in a reset or firmware crash state before initiating a system reboot or shutdown

Generated by OpenCVE AI on August 17, 2026 at 14:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 17 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-476

Mon, 17 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-476

Mon, 17 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 15 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-476

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts. Simplified trace: dma_free_attrs mhi_deinit_dev_ctxt [mhi] ath11k_pci_power_down [ath11k_pci] ath11k_pci_shutdown [ath11k_pci] device_shutdown kernel_restart On the host side, SSR is driven by the MHI RDDM callback, which queues reset_work to perform device recovery. reset_work power-cycles the device by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The power-down phase deinitializes MHI and frees DMA resources. Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR recovery flow. As a result, the shutdown path (ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR recovery sequence. Fix this by canceling SSR-related work items during PCI shutdown, marking the device as unregistering, and serializing the RDDM callback path that checks and queues reset_work. This ensures that no new SSR recovery work can be queued once teardown has started, and that any in-flight recovery work is fully synchronized before device power-down, preventing MHI teardown and DMA resource freeing from running more than once. Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k devices do not queue reset_work in normal SSR flows. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
Title wifi: ath11k: cancel SSR work items during PCI shutdown
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:46:50.498Z

Reserved: 2026-08-15T05:44:03.892Z

Link: CVE-2026-74407

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:42.737

Modified: 2026-08-17T06:19:35.977

Link: CVE-2026-74407

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74407 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T14:15:04Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-476

    NULL Pointer Dereference