{"id":33376,"date":"2026-10-06T20:31:52","date_gmt":"2026-10-06T12:31:52","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98307"},"modified":"2026-10-06T20:31:52","modified_gmt":"2026-10-06T12:31:52","slug":"cve-2026-98307","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98307","title":{"rendered":"CVE-2026-98307 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cleanup"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()<\/p>\n<p>When mac80211 removes a sta, it calls .sta_state() which in turn calls<br \/>\nath11k_mac_station_remove(). In that function we clean up both peers &amp;<br \/>\narsta related resources.<\/p>\n<p>But when the firmware crashes, ath11k calls ieee80211_restart_hw(), which<br \/>\nassumes that all driver related resources are cleaned up beforehand. This<br \/>\ncleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not<br \/>\nin fact free arsta-&gt;rx_stats \/ tx_stats.<\/p>\n<p>Extract the arsta cleanup from ath11k_mac_station_remove() into a<br \/>\nnew ath11k_mac_station_cleanup() and call it from both there and<br \/>\nath11k_mac_peer_cleanup_all().<\/p>\n<p>This should handle kmemleaks reports like:<br \/>\n\tunreferenced object 0xffffff801ae66400 (size 1024):<br \/>\n\t  comm &#8220;hostapd&#8221;, pid 1306, jiffies 4295011565<br \/>\n\t  hex dump (first 32 bytes):<br \/>\n\t    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#8230;&#8230;&#8230;&#8230;&#8230;.<br \/>\n\t    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#8230;&#8230;&#8230;&#8230;&#8230;.<br \/>\n\t  backtrace (crc d61c08ec):<br \/>\n\t    kmemleak_alloc+0x3c\/0x50<br \/>\n\t    __kmalloc_cache_noprof+0x2b0\/0x3e0<br \/>\n\t    ath11k_mac_op_sta_state+0x1dc\/0xb10<br \/>\n\t    drv_sta_state+0xac\/0x6f8<br \/>\n\t    sta_info_insert_rcu+0x314\/0x5e0<br \/>\n\t    sta_info_insert+0x14\/0x38<br \/>\n\t    ieee80211_add_station+0x10c\/0x1a0<br \/>\n\t    nl80211_new_station+0x3e8\/0x680<br \/>\n\t    genl_family_rcv_msg_doit+0xc0\/0x120<br \/>\n\t    genl_rcv_msg+0x1b4\/0x258<br \/>\n\t    netlink_rcv_skb+0x4c\/0x108<br \/>\n\t    genl_rcv+0x38\/0x60<br \/>\n\t    netlink_unicast+0x190\/0x278<br \/>\n\t    netlink_sendmsg+0x15c\/0x370<br \/>\n\t    ____sys_sendmsg+0x120\/0x290<br \/>\n\t    ___sys_sendmsg+0x70\/0xa0<\/p>\n<p>Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()<\/p>\n<p>When mac80211 removes a sta, it calls .sta_state() which in turn call<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33376","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33376","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33376"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33376"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33376"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}