CVE-2026-74407: wifi: ath11k: cancel SSR work items during PCI shutdown
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: cancel SSR work items during PCI shutdown
A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts.
Simplified trace: dmafreeattrs mhideinitdevctxt [mhi] ath11kpcipowerdown [ath11kpci] ath11kpcishutdown [ath11kpci] deviceshutdown kernelrestart
On the host side, SSR is driven by the MHI RDDM callback, which queues resetwork to perform device recovery. resetwork power-cycles the device by calling ath11khifpowerdown() followed by ath11khifpowerup(). The power-down phase deinitializes MHI and frees DMA resources.
Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR recovery flow. As a result, the shutdown path (ath11kpcishutdown() -> ath11kpcipowerdown()) can race with the SSR recovery sequence.
Fix this by canceling SSR-related work items during PCI shutdown, marking the device as unregistering, and serializing the RDDM callback path that checks and queues resetwork. This ensures that no new SSR recovery work can be queued once teardown has started, and that any in-flight recovery work is fully synchronized before device power-down, preventing MHI teardown and DMA resource freeing from running more than once.
Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k devices do not queue resetwork in normal SSR flows.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPLV1V2SILICONZIOE-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/upgrade the Linux kernel to the version where the ath11k PCI shutdown logic cancels SSR-related work items (reset_work and any queued SSR recovery work) during PCI shutdown and serializes the RDDM callback path so no in-flight recovery can run while MHI teardown frees DMA resources (prevents NULL pointer dereference in mhi_deinit_dev_ctxt).
Linux kernel (ath11k + MHI, PCI/MHI-based devices) cancel SSR work items during PCI shutdown = implemented (serialize RDDM callback path; synchronize SSR work before device power-down)