{"id":7364,"date":"2026-09-04T18:49:31","date_gmt":"2026-09-04T10:49:31","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74407"},"modified":"2026-09-04T18:49:31","modified_gmt":"2026-09-04T10:49:31","slug":"cve-2026-74407","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74407","title":{"rendered":"CVE-2026-74407 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cancel"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: ath11k: cancel SSR work items during PCI shutdown<\/p>\n<p>A reboot can crash the kernel if it overlaps with WLAN firmware crash<br \/>\nrecovery (SSR). The crash is a NULL pointer dereference in the MHI teardown<br \/>\npath while freeing DMA-backed MHI contexts.<\/p>\n<p>Simplified trace:<br \/>\n  dma_free_attrs<br \/>\n  mhi_deinit_dev_ctxt [mhi]<br \/>\n  ath11k_pci_power_down [ath11k_pci]<br \/>\n  ath11k_pci_shutdown [ath11k_pci]<br \/>\n  device_shutdown<br \/>\n  kernel_restart<\/p>\n<p>On the host side, SSR is driven by the MHI RDDM callback, which queues<br \/>\nreset_work to perform device recovery. reset_work power-cycles the device<br \/>\nby calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The<br \/>\npower-down phase deinitializes MHI and frees DMA resources.<\/p>\n<p>Shutdown\/reboot runs fully asynchronously with this RDDM-driven SSR<br \/>\nrecovery flow. As a result, the shutdown path<br \/>\n(ath11k_pci_shutdown() -&gt; ath11k_pci_power_down()) can race with the SSR<br \/>\nrecovery sequence.<\/p>\n<p>Fix this by canceling SSR-related work items during PCI shutdown, marking<br \/>\nthe device as unregistering, and serializing the RDDM callback path that<br \/>\nchecks and queues reset_work. This ensures that no new SSR recovery work<br \/>\ncan be queued once teardown has started, and that any in-flight recovery<br \/>\nwork is fully synchronized before device power-down, preventing MHI<br \/>\nteardown and DMA resource freeing from running more than once.<\/p>\n<p>Note: This issue only affects PCI\/MHI-based devices. AHB-based ath11k<br \/>\ndevices do not queue reset_work in normal SSR flows.<\/p>\n<p>Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: ath11k: cancel SSR work items during PCI shutdown<\/p>\n<p>A reboot can crash the kernel if it overlaps with WLAN firmware crash<br \/>\nreco<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7364","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}