All vulnerabilities
CVE-2026-98936

Linux: wifi: ath11k: reset ar->num_stations on hardware start

Linux LinuxOperating systems
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in60142eb2afda34508e640a3ff2a54c90e51525ccAlso 9a9467f7cc633b31e4c34a2c56aa095e0c3fa853, 7e0ad05ebc72fffba2bdf2400400902d94ed7272CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 60142eb2afda34508e640a3ff2a54c90e51525ccLinuxCVE List
  • 9a9467f7cc633b31e4c34a2c56aa095e0c3fa853LinuxCVE List
  • 7e0ad05ebc72fffba2bdf2400400902d94ed7272LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: reset ar->num_stations on hardware start

When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num_stations' in 'struct ath11k' that did not get reset properly in this case. In ath11k_mac_op_start(), it was indeed the only accounting var that did not get reset so let's clear it too.

This avoids problems like those:

[1248828.088023] WARNING: CPU: 0 PID: 12281 at net/mac80211/util.c:1682 ieee80211_reconfig_stations+0x98/0xc0 [1248828.088115] Call trace: [1248828.088116] ieee80211_reconfig_stations+0x98/0xc0 (P) [1248828.088119] ieee80211_reconfig+0x774/0x1438 [1248828.088123] ieee80211_restart_work+0x10c/0x178 [1248828.088127] process_one_work+0x178/0x3c0 [1248828.088130] worker_thread+0x280/0x440 [1248828.088133] kthread+0xe0/0xf8 [1248828.088137] ret_from_fork+0x10/0x20 [1248828.088141] ---[ end trace 0000000000000000 ]--- [1248836.686604] ath11k_pci 0000:04:00.0: refusing to associate station: too many connected already (128) [1248836.686609] ath11k_pci 0000:04:00.0: Failed to add station: xx:xx:xx:xx:xx:xx for VDEV: 1

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1

Text from CVE List

Affected versions 12

  • Linuxaffected: d5c65159f2895379e11ca13f62feabe93278985d before 60142eb2afda34508e640a3ff2a54c90e51525ccCVE List
  • Linuxaffected: d5c65159f2895379e11ca13f62feabe93278985d before c3ac51701e925e8d50479ae2fddca51a09f636e8CVE List
  • Linuxaffected: d5c65159f2895379e11ca13f62feabe93278985d before 9a9467f7cc633b31e4c34a2c56aa095e0c3fa853CVE List
  • Linuxaffected: d5c65159f2895379e11ca13f62feabe93278985d before c27779d3679c695674747744390f97a5424a0dc8CVE List
  • Linuxaffected: d5c65159f2895379e11ca13f62feabe93278985d before 7e0ad05ebc72fffba2bdf2400400902d94ed7272CVE List
  • Linuxaffected: 5.6CVE List
  • Linuxunaffected: all versions before 5.6CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5