Към съдържанието
Търсене

CVE-2026-74407: Linux

8.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се от съседна мрежа, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts. Simplified trace: dma_free_attrs mhi_deinit_dev_ctxt [mhi] ath11k_pci_power_down [ath11k_pci] ath11k_pci_shutdown [ath11k_pci] device_shutdown kernel_restart On the host side, SSR is driven by the MHI RDDM callback, which queues reset_work to perform device recovery. reset_work power-cycles the device by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The power-down phase deinitializes MHI and frees DMA resources. Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR recovery flow. As a result, the shutdown path (ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR recovery sequence. Fix this by canceling SSR-related work items during PCI shutdown, marking the device as unregistering, and serializing the RDDM callback path that checks and queues reset_work. This ensures that no new SSR recovery work can be queued once teardown has started, and that any in-flight recovery work is fully synchronized before device power-down, preventing MHI teardown and DMA resource freeing from running more than once. Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k devices do not queue reset_work in normal SSR flows. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1

Засегнати продукти

  • Linux Linux: 13da397f884d9c9a3fb6616206eeb6c6ab097287 преди 7630eb217166435e8a6dd501fa4ad304e2264407; 13da397f884d9c9a3fb6616206eeb6c6ab097287 преди f82d42577ee4a191b0ad0f0a3b49fc1935dff845; 13da397f884d9c9a3fb6616206eeb6c6ab097287 преди daeb44fb8d700654f37f54d1ee36cd67645d0d34; 13da397f884d9c9a3fb6616206eeb6c6ab097287 преди 6dd3701facc0cee62d6682e49eed64499f9d0e43; 13da397f884d9c9a3fb6616206eeb6c6ab097287 преди 53dd29e8aeb2a1b5f079178551836b85fc6b53df; 13da397f884d9c9a3fb6616206eeb6c6ab097287 преди 8c79aac429b583301f387374ff37c59be671df87
  • Linux Linux: 5.19; преди 5.19; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.53 до 6.18.*; 7.1.5 до 7.1.*; от 7.2 нататък

История

  • 15 август 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-74407: Linux | freedomonline.bg