Executive brief
A race condition in the Linux kernel's WiFi driver (ath11k) can cause a system crash during reboot if it overlaps with firmware crash recovery. The crash occurs when the kernel tries to clean up memory resources while the driver is simultaneously attempting to recover from a wireless firmware failure, resulting in a NULL pointer dereference that brings down the system.
Technical details
The vulnerability is a race condition (CWE-362) in the ath11k WiFi driver's handling of Subsystem Reset (SSR) during PCI device shutdown. When a WLAN firmware crash occurs, the MHI RDDM callback queues reset_work to perform recovery, which power-cycles the device. If a system reboot occurs concurrently, the shutdown path (ath11k_pci_shutdown → ath11k_pci_power_down) races with the SSR recovery sequence. This can cause the MHI teardown path to attempt freeing DMA-backed contexts that are simultaneously being accessed, resulting in a NULL pointer dereference in dma_free_attrs. The fix involves canceling SSR work items during PCI shutdown, marking the device as unregistering, and serializing the RDDM callback to prevent new recovery work from being queued after teardown begins. This issue affects only PCI/MHI-based ath11k devices; AHB-based variants are unaffected.
Affected products
- Linux Linux kernel Affected versions not specified; PCI/MHI-based ath11k devices only
Timeline
- 2026-08-15: disclosed