{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-74407",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-74407"
  ],
  "published": "2026-08-15T06:04:33Z",
  "summary": "wifi: ath11k: cancel SSR work items during PCI shutdown",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cancel SSR work items during PCI shutdown\n\nA reboot can crash the kernel if it overlaps with WLAN firmware crash\nrecovery (SSR). The crash is a NULL pointer dereference in the MHI teardown\npath while freeing DMA-backed MHI contexts.\n\nSimplified trace:\n  dma_free_attrs\n  mhi_deinit_dev_ctxt [mhi]\n  ath11k_pci_power_down [ath11k_pci]\n  ath11k_pci_shutdown [ath11k_pci]\n  device_shutdown\n  kernel_restart\n\nOn the host side, SSR is driven by the MHI RDDM callback, which queues\nreset_work to perform device recovery. reset_work power-cycles the device\nby calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The\npower-down phase deinitializes MHI and frees DMA resources.\n\nShutdown/reboot runs fully asynchronously with this RDDM-driven SSR\nrecovery flow. As a result, the shutdown path\n(ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR\nrecovery sequence.\n\nFix this by canceling SSR-related work items during PCI shutdown, marking\nthe device as unregistering, and serializing the RDDM callback path that\nchecks and queues reset_work. This ensures that no new SSR recovery work\ncan be queued once teardown has started, and that any in-flight recovery\nwork is fully synchronized before device power-down, preventing MHI\nteardown and DMA resource freeing from running more than once.\n\nNote: This issue only affects PCI/MHI-based devices. AHB-based ath11k\ndevices do not queue reset_work in normal SSR flows.\n\nTested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": null,
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74407"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6dd3701facc0cee62d6682e49eed64499f9d0e43"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/53dd29e8aeb2a1b5f079178551836b85fc6b53df"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8c79aac429b583301f387374ff37c59be671df87"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-21T13:30:03Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:A - WiFi ath11k PCI/MHI devices (QCA6390/WCN6855 laptops, workstations, gateways) enter SSR when WLAN firmware faults; MHI RDDM interrupts queue reset_work recovery that races kernel_restart PCI shutdown (ath11k_pci_shutdown) on the same driver.\nAC:L - An adjacent attacker controls SSR timing by repeatedly inducing firmware crashes via crafted/malicious 802.11 traffic, keeping reset_work active until shutdown overlaps; this is an attacker-driven race, not luck-dependent memory layout or rare kernel config.\nPR:N - No Linux account or kernel capability is needed to trigger the SSR leg\u2014firmware crash/RDDM recovery is driven by over-the-air WLAN events; concurrent device_shutdown during automated maintenance or fleet reboots can overlap without attacker CAP_SYS_BOOT.\nUI:N - Only an active ath11k WLAN interface is required (default on WiFi-equipped systems); no victim clicks, network joins, or manual reboot actions are needed because unattended updates and scheduled maintenance reboots can overlap SSR automatically.\nS:U - Impact is kernel panic/oops from unsynchronized MHI DMA teardown within the host kernel security boundary; this does not cross VM, container, or IOMMU trust domains.\nC:H - Concurrent mhi_unprepare_after_power_down/mhi_deinit_dev_ctxt from reset_work and ath11k_pci_shutdown can double-free coherent DMA rings/contexts or dereference freed MHI state, enabling arbitrary kernel memory reads and information disclosure.\nI:H - Racing power-down paths free the same MHI DMA-backed ring/context memory twice, corrupting kernel DMA allocator metadata and enabling controlled reallocation for arbitrary kernel writes, control-flow hijack, and privilege escalation.\nA:H - NULL pointer dereference and/or double dma_free in mhi_deinit_dev_ctxt during PCI shutdown overlapping SSR reliably causes kernel oops/panic, denying availability and potentially aborting reboot on affected Qualcomm ath11k PCI systems."
    }
  }
}