CVE-2026-98936: wifi: ath11k: reset ar->num_stations on hardware start
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: reset ar->numstations on hardware start
When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not get reset properly in this case. In ath11kmacopstart(), it was indeed the only accounting var that did not get reset so let's clear it too.
This avoids problems like those:
[1248828.088023] WARNING: CPU: 0 PID: 12281 at net/mac80211/util.c:1682 ieee80211reconfigstations+0x98/0xc0 [1248828.088115] Call trace: [1248828.088116] ieee80211reconfigstations+0x98/0xc0 (P) [1248828.088119] ieee80211reconfig+0x774/0x1438 [1248828.088123] ieee80211restartwork+0x10c/0x178 [1248828.088127] processonework+0x178/0x3c0 [1248828.088130] workerthread+0x280/0x440 [1248828.088133] kthread+0xe0/0xf8 [1248828.088137] retfromfork+0x10/0x20 [1248828.088141] ---[ end trace 0000000000000000 ]--- [1248836.686604] ath11kpci 0000:04:00.0: refusing to associate station: too many connected already (128) [1248836.686609] ath11kpci 0000:04:00.0: Failed to add station: xx:xx:xx:xx:xx:xx for VDEV: 1
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPLSILICONZ-1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Reset ar->num_stations on hardware start, including after hardware restart, so station accounting is cleared and new stations or mesh peers can be accepted.
Linux kernel ath11k ar->num_stations = reset