CVE-2026-74407

A flaw was found in the Linux kernel's ath11k Wi-Fi driver. A race condition exists between the system's reboot or shutdown process and the WLAN firmware crash recovery (SSR) mechanism. This race condition can lead to a NULL pointer dereference, causing the kernel to crash and resulting in a Denial of Service (DoS). This issue specifically affects PCI/MHI-based devices.

A race in ath11k PCI shutdown can overlap with firmware crash recovery SSR work. The RDDM callback can queue reset_work, while the shutdown path also calls ath11k_pci_power_down, so MHI teardown and DMA backed context freeing can run in an unsafe overlapping sequence. The observed failure is a NULL pointer dereference in the MHI teardown path during reboot, causing a kernel crash. For the CVSS the PR:L is used in the paranoid score for environments where a lower privileged local process or service can trigger firmware recovery or device reset behavior while shutdown is in progress. The base case is closer to PR:H because reboot and PCI teardown are normally administrator controlled. The issue is not directly network reachable from the patch context. Impact is at least denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.