CVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: cancel SSR work items during PCI shutdown

A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts.

Simplified trace: dmafreeattrs mhideinitdevctxt [mhi] ath11kpcipowerdown [ath11kpci] ath11kpcishutdown [ath11kpci] deviceshutdown kernelrestart

On the host side, SSR is driven by the MHI RDDM callback, which queues resetwork to perform device recovery. resetwork power-cycles the device by calling ath11khifpowerdown() followed by ath11khifpowerup(). The power-down phase deinitializes MHI and frees DMA resources.

Shutdown/reboot runs fully asynchronously with this RDDM-driven SSR recovery flow. As a result, the shutdown path (ath11kpcishutdown() -> ath11kpcipower_down()) can race with the SSR recovery sequence.

Fix this by canceling SSR-related work items during PCI shutdown, marking the device as unregistering, and serializing the RDDM callback path that checks and queues reset_work. This ensures that no new SSR recovery work can be queued once teardown has started, and that any in-flight recovery work is fully synchronized before device power-down, preventing MHI teardown and DMA resource freeing from running more than once.

Note: This issue only affects PCI/MHI-based devices. AHB-based ath11k devices do not queue reset_work in normal SSR flows.

Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04866.5-QCAHSPSWPLV1V2SILICONZIOE-1