{"id":"CVE-2026-74407","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cancel SSR work items during PCI shutdown\n\nA reboot can crash the kernel if it overlaps with WLAN firmware crash\nrecovery (SSR)","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cancel SSR work items during PCI shutdown\n\nA reboot can crash the kernel if it overlaps with WLAN firmware crash\nrecovery (SSR). The crash is a NULL point…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 13da397f884d9c9a3fb6616206eeb6c6ab097287 < 6dd3701facc0cee62d6682e49eed64499f9d0e43","Linux >= 13da397f884d9c9a3fb6616206eeb6c6ab097287 < 53dd29e8aeb2a1b5f079178551836b85fc6b53df","Linux >= 13da397f884d9c9a3fb6616206eeb6c6ab097287 < 8c79aac429b583301f387374ff37c59be671df87","Linux 5.19"],"published":"2026-08-15","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:17:19.040","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74407","references":[{"url":"https://git.kernel.org/stable/c/53dd29e8aeb2a1b5f079178551836b85fc6b53df","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6dd3701facc0cee62d6682e49eed64499f9d0e43","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c79aac429b583301f387374ff37c59be671df87","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00239,"epssPercentile":0.15224,"ingestedAt":"2026-09-21T13:37:22.838Z","slug":"CVE-2026-74407","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cancel SSR work items during PCI shutdown\n\nA reboot can crash the kernel if it overlaps with WLAN firmware crash\nrecovery (SSR). The crash is a NULL pointer dereference in the MHI teardown\npath while freeing DMA-backed MHI contexts.\n\nSimplified trace:\n  dma_free_attrs\n  mhi_deinit_dev_ctxt [mhi]\n  ath11k_pci_power_down [ath11k_pci]\n  ath11k_pci_shutdown [ath11k_pci]\n  device_shutdown\n  kernel_restart\n\nOn the host side, SSR is driven by the MHI RDDM callback, which queues\nreset_work to perform device recovery. reset_work power-cycles the device\nby calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The\npower-down phase deinitializes MHI and frees DMA resources.\n\nShutdown/reboot runs fully asynchronously with this RDDM-driven SSR\nrecovery flow. As a result, the shutdown path\n(ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR\nrecovery sequence.\n\nFix this by canceling SSR-related work items during PCI shutdown, marking\nthe device as unregistering, and serializing the RDDM callback path that\nchecks and queues reset_work. This ensures that no new SSR recovery work\ncan be queued once teardown has started, and that any in-flight recovery\nwork is fully synchronized before device power-down, preventing MHI\nteardown and DMA resource freeing from running more than once.\n\nNote: This issue only affects PCI/MHI-based devices. AHB-based ath11k\ndevices do not queue reset_work in normal SSR flows.\n\nTested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}