Double Free Vulnerability in ath11k Driver for Linux Kernel

CVE-2026-63822

What is CVE-2026-63822?

A vulnerability exists in the ath11k driver of the Linux kernel that can lead to a double free error during firmware initialization. When an error occurs, the tx_status buffers are incorrectly released and again released when the device is unbound, resulting in a potential warning during operation. This issue is reproducible in virtual machine environments due to failures in MSI addressing initialization. To address this vulnerability, it is recommended to nullify the buffers after their initial release to prevent the double free occurrence.

References