CVE-2026-74407

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: cancel SSR work items during PCI shutdown

A reboot can crash the kernel if it overlaps with WLAN firmware crash

recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown

path while freeing DMA-backed MHI contexts.

Simplified trace:

dma_free_attrs

mhi_deinit_dev_ctxt [mhi]

ath11k_pci_power_down [ath11k_pci]

ath11k_pci_shutdown [ath11k_pci]

device_shutdown

kernel_restart

On the host side, SSR is driven by the MHI RDDM callback, which queues

reset_work to perform device recovery. reset_work power-cycles the device

by calling ath11k_hif_power_down() followed by ath11k_hif_power_up(). The

power-down phase deinitializes MHI and frees DMA resources.

Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR

recovery flow. As a result, the shutdown path

(ath11k_pci_shutdown() -> ath11k_pci_power_down()) can race with the SSR

recovery sequence.

Fix this by canceling SSR

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References