CVE-2026-63822

What it actually does

This vulnerability is a Linux kernel memory-management flaw in the ath11k Wi-Fi driver. During certain firmware/MSI-related initialization failure paths, the driver frees tx_status buffers associated with transmit rings but does not clear the corresponding pointers. When the ath11k PCI device is later unbound or removed, cleanup code attempts to free the same buffers again, triggering a double-free condition in kernel memory management. The observed result is a kernel warning in SLUB/free_large_kmalloc and potentially driver instability, kernel memory corruption, or system crash depending on kernel configuration, allocator behavior, and reachability of the affected failure path.

Why it matters to the business

Systems using affected Linux kernels with Qualcomm ath11k-supported Wi-Fi hardware may experience instability, kernel warnings, failed device removal, or crashes when the driver initialization path fails and the device is unbound. The currently reported exploitation likelihood is low, with EPSS at 0.00174, no known public exploit maturity, no CISA KEV listing, and no ransomware association. Operationally, the main risk is availability impact on Linux endpoints, embedded devices, appliances, or test/virtualized environments that load the ath11k driver, especially where Wi-Fi hardware or driver unbind/rebind workflows are common.

How an attack unfolds

An attacker would need a way to cause or influence the ath11k driver to enter the vulnerable initialization failure path and then trigger device unbind or removal so that cleanup routines execute twice on the same buffer. The described reproducible case occurs when MSI address initialization fails, such as in a VM or environment where PCI/MSI setup does not complete correctly. After the first cleanup releases dp->tx_ring[i].tx_status, the stale pointer remains populated. During ath11k_pci_remove, ath11k_core_deinit, and ath11k_dp_free, the driver attempts to free the same allocation again, producing a kernel warning and potentially causing memory corruption or a denial-of-service condition. There is no indication from the provided data that this is being exploited in the wild or used by named threat actors.

How to fix it

Apply a Linux kernel update that includes the ath11k fix setting tx_status buffer pointers to NULL immediately after they are freed on initialization failure paths. Because no exact affected product list or fixed package versions were provided, track the fix through the relevant Linux distribution kernel advisories, upstream stable kernel releases, and vendor firmware/driver update channels. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the ath11k driver on systems that do not require Qualcomm ath11k Wi-Fi support, avoiding unnecessary driver unbind/rebind workflows, and restricting local administrative access that can manipulate PCI device binding, kernel modules, or driver removal. For embedded or appliance builds, rebuild with a patched kernel or backport the ath11k change that nulls freed tx_status pointers after release.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel includes the ath11k fix for the double-free-on-unbind condition. Practical validation steps include checking distribution security advisories and kernel changelogs for the ath11k unbind/double-free fix, confirming the installed kernel version is at or above the vendor-fixed release once available, and testing the previously failing initialization/unbind path in a controlled environment. After applying the fix, unbinding or removing the ath11k PCI device following an initialization failure should no longer produce kernel warnings referencing free_large_kmalloc, ath11k_dp_free, ath11k_core_deinit, or ath11k_pci_remove. Also verify that the ath11k module is not loaded on systems where it has been intentionally disabled.

Typical attack path

1. Identify a Linux system running an affected kernel with the ath11k Wi-Fi driver available or loaded.
2. Cause the ath11k device initialization path to fail during firmware/MSI-related setup, or operate in an environment where MSI initialization reliably fails.
3. Trigger device unbind, driver removal, PCI device removal, module unload, reboot, or another cleanup path that invokes ath11k_pci_remove.
4. The cleanup path calls ath11k_core_deinit and ath11k_dp_free, attempting to free tx_status buffers that were already freed during failed initialization.
5. The kernel emits a SLUB/free_large_kmalloc warning and may experience driver instability, memory corruption, or a crash depending on runtime conditions.

How to detect it

To determine whether the vulnerable condition has already occurred, review kernel logs and persistent system journals for ath11k driver initialization failures followed by device removal or unbind events and SLUB memory-free warnings. Relevant sources include dmesg output, /var/log/kern.log, /var/log/messages, /var/log/syslog, systemd journal entries for the kernel, crash dumps, kdump/vmcore artifacts, and endpoint telemetry that records kernel oops or warning events. Look for call traces containing free_large_kmalloc, ath11k_dp_free, ath11k_core_deinit, and ath11k_pci_remove, especially when preceded by ath11k firmware initialization, MSI initialization, or PCI probe failures. Also search for administrative or automation activity that unbound PCI devices or unloaded ath11k modules near the time of the warning. There are no provided network indicators, file-drop artifacts, or threat-actor-specific indicators for this issue; detection is primarily host-log and kernel-crash based.

• WARNING: CPU:
• free_large_kmalloc
• mm/slub.c:4368
• ath11k_dp_free
• ath11k_core_deinit
• ath11k_pci_remove
• ath11k_pci
• ath11k
• tx_status
• MSI addressing initialization is failing
• /sys/bus/pci/drivers/ath11k_pci/unbind
• modprobe -r ath11k
• modprobe -r ath11k_pci
• rmmod ath11k
• rmmod ath11k_pci

What your security team should do

• Prioritize inventory: identify Linux systems with ath11k hardware support, the ath11k/ath11k_pci modules loaded, or kernels built with CONFIG_ATH11K and CONFIG_ATH11K_PCI.
• Patch affected Linux kernels through distribution or vendor channels as soon as fixed builds are available, especially on systems where ath11k Wi-Fi is used or driver unbind/rebind operations are routine.
• If patching is delayed and ath11k Wi-Fi is unnecessary, disable or blacklist ath11k and ath11k_pci modules to remove the vulnerable code path.
• Monitor kernel logs for SLUB double-free warnings and ath11k cleanup stack traces that may indicate the vulnerable condition was reached.
• Restrict access to administrative interfaces that allow module unload, PCI driver unbind, device passthrough changes, or low-level hardware manipulation.
• Treat this as lower urgency than actively exploited internet-facing vulnerabilities because it is not in KEV, has low EPSS, has no known exploit maturity, and has no reported ransomware usage, but still remediate through normal kernel maintenance cycles.