CVE-2026-74407

Received Received - Intake

Kernel Crash Due to Race Condition in Ath11k PCI Shutdown

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts. Simplified trace: dma_free_attrs mhi_deinit_dev_ctxt [mhi] ath11k_pci_power_down [ath11k_pci] ath11k_pci_shutdown [ath11k_pci] device_shutdown kernel_restart On the host side, SSR is driven by the MHI RDDM callback, which queues reset_work to perform device recovery. reset_work power-cycles the device by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The power-down phase deinitializes MHI and frees DMA resources. Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR recovery flow. As a result, the shutdown path (ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR recovery sequence. Fix this by canceling SSR-related work items during PCI shutdown, marking the device as unregistering, and serializing the RDDM callback path that checks and queues reset_work. This ensures that no new SSR recovery work can be queued once teardown has started, and that any in-flight recovery work is fully synchronized before device power-down, preventing MHI teardown and DMA resource freeing from running more than once. Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k devices do not queue reset_work in normal SSR flows. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74407

EUVD

EUVD-2026-59554

Affected Vendors & Products

Vendor	Product	Version / Range
qualcomm	ath11k	From 2.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition during system reboot or shutdown when combined with a WLAN firmware crash recovery (SSR). The crash occurs as a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts. The issue arises because the shutdown process and SSR recovery run asynchronously, leading to potential double-free or resource conflicts.

Detection Guidance

This vulnerability is specific to PCI/MHI-based ath11k devices in the Linux kernel. Detection requires checking the kernel version and ath11k driver status. Use 'uname -a' to verify the kernel version and 'lsmod | grep ath11k' to confirm the driver is loaded. If the system uses a vulnerable kernel version without the fix, it may be affected.

Impact Analysis

This vulnerability can cause kernel crashes during system reboot or shutdown if it overlaps with WLAN firmware recovery. This may result in system instability, data loss, or denial of service. Users may experience unexpected system failures when rebooting or shutting down affected devices.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a kernel-level issue in the Linux ath11k WiFi driver that could cause system crashes during reboot if firmware recovery overlaps with shutdown. No data exposure or privacy implications are described.

Mitigation Strategies

Apply the kernel update that includes the fix for this vulnerability. The fix involves canceling SSR work items during PCI shutdown and serializing the RDDM callback path. Check your Linux distribution's security advisories for the patched kernel version and update accordingly.

Hi! I’m here to help you understand CVE-2026-74407. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70