CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath11k: cancel SSR work items during PCI shutdown<br /> <br /> A reboot can crash the kernel if it overlaps with WLAN firmware crash<br /> recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown<br /> path while freeing DMA-backed MHI contexts.<br /> <br /> Simplified trace:<br /> dma_free_attrs<br /> mhi_deinit_dev_ctxt [mhi]<br /> ath11k_pci_power_down [ath11k_pci]<br /> ath11k_pci_shutdown [ath11k_pci]<br /> device_shutdown<br /> kernel_restart<br /> <br /> On the host side, SSR is driven by the MHI RDDM callback, which queues<br /> reset_work to perform device recovery. reset_work power-cycles the device<br /> by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The<br /> power-down phase deinitializes MHI and frees DMA resources.<br /> <br /> Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR<br /> recovery flow. As a result, the shutdown path<br /> (ath11k_pci_shutdown() -&gt; ath11k_pci_power_down()) can race with the SSR<br /> recovery sequence.<br /> <br /> Fix this by canceling SSR-related work items during PCI shutdown, marking<br /> the device as unregistering, and serializing the RDDM callback path that<br /> checks and queues reset_work. This ensures that no new SSR recovery work<br /> can be queued once teardown has started, and that any in-flight recovery<br /> work is fully synchronized before device power-down, preventing MHI<br /> teardown and DMA resource freeing from running more than once.<br /> <br /> Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k<br /> devices do not queue reset_work in normal SSR flows.<br /> <br /> Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1