CVE-2026-98307

What it actually does

Incomplete cleanup of per-station rx_stats and tx_stats buffers in the ath11k WiFi driver when ieee80211_restart_hw is invoked after firmware crash, leaving allocated kernel objects unreferenced.

Why it matters to the business

Gradual kernel memory exhaustion on systems using ath11k hardware after repeated firmware restarts, potentially causing performance degradation or instability during long-running WiFi operations; low exploitation risk and no ransomware association reduce urgency.

How an attack unfolds

An attacker with the ability to trigger ath11k firmware crashes and subsequent station state transitions (via mac80211 or nl80211) can cause repeated allocation without corresponding free, leading to memory leaks; no known threat actor campaigns or public exploits exist.

How to fix it

Apply a kernel update that moves arsta cleanup into the new ath11k_mac_station_cleanup function and ensures it is called from both ath11k_mac_station_remove and ath11k_mac_peer_cleanup_all.

How to confirm the fix worked

Inspect driver source for the new ath11k_mac_station_cleanup helper; run kmemleak after simulated firmware restarts and confirm absence of unreferenced 1024-byte ath11k objects.

Typical attack path

1. Trigger ath11k firmware crash to invoke ieee80211_restart_hw
2. Perform repeated station addition and removal operations
3. Trigger kernel memory leak of arsta statistics structures
4. Monitor for cumulative memory growth until resource exhaustion

How to detect it

Search kernel logs and kmemleak reports for backtraces containing ath11k_mac_op_sta_state, __kmalloc_cache_noprof, and unreferenced objects sized 1024 bytes associated with station management.

What your security team should do

• Prioritize kernel updates for ath11k users once released
• Enable kmemleak debugging on test systems using ath11k hardware
• Monitor ath11k firmware crash logs for early restart_hw events