Kernel Vulnerability Affecting Linux with Ath11k PCI Devices

CVE-2026-74407

What is CVE-2026-74407?

A vulnerability in the Ath11k PCI driver within the Linux kernel can lead to a system crash during reboot if it coincides with WLAN firmware crash recovery. This is due to a NULL pointer dereference occurring in the MHI teardown path as DMA-backed MHI resources are being freed. The issue arises when the shutdown process runs asynchronously with the recovery sequence managed by the MHI RDDM callback, potentially resulting in a race condition. Proper mitigation involves canceling SSR-related work items before executing PCI shutdown, ensuring device state is appropriately managed and preventing multiple executions of resource deallocation.

References