Linux Kernel CVE-2026-74407

Exploitation requires a Linux system equipped with a Qualcomm PCI-attached WiFi chipset using the ath11k_pci driver (confirmed affected hardware: WCN6855 hw2.1 PCI), running kernel versions from 5.19 up to but not including 7.1.5 or 7.2-rc1. Two concurrent conditions must coincide within the same race window: (1) a WLAN firmware crash must occur to trigger the MHI RDDM callback and queue the SSR reset_work recovery sequence, and (2) a system reboot or shutdown must be initiated before that recovery work completes. AHB-based ath11k devices are explicitly not affected per vendor documentation, as they do not queue reset_work in normal SSR flows. The narrow timing window required significantly limits deliberate exploitation; the predominant real-world scenario is an accidental crash during reboot on hardware experiencing firmware instability. CVSS PR:N is retained from the vendor vector as the WiFi firmware crash could theoretically be induced from the adjacent network, but the simultaneous reboot requirement limits practical attacker control.

The vendor-assigned CVSS score of 8.8 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) is likely materially overstated for this vulnerability. The description provides no mechanism for confidentiality (C:H) or integrity (I:H) compromise - the documented impact is a kernel panic, which is pure availability loss. The AC:L rating also conflicts with the race-condition nature of the vulnerability, which requires precise timing alignment between a firmware crash event and a concurrent system reboot - a high-complexity precondition. The EPSS score of 0.15% (5th percentile) correctly reflects that real-world exploitation is very unlikely. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exists. The practical risk profile is an unintended crash on specific hardware during reboot, not a targeted remotely weaponizable attack. The adjacent vector (AV:A) may reflect that a WiFi-adjacent attacker could theoretically trigger a firmware crash, but without control over the reboot timing, reliable exploitation is not achievable. Defenders should treat this as a stability fix for Qualcomm ath11k PCI hardware rather than an emergency security patch, while still prioritizing kernel upgrades to 7.1.5 or 7.2-rc1.

A system experiences a spontaneous WLAN firmware crash on its Qualcomm ath11k PCI WiFi chipset, triggering the MHI RDDM callback and queuing SSR reset_work for device recovery. Concurrently, an administrator initiates a system reboot (or a scheduled reboot fires), and the kernel's ath11k_pci_shutdown path begins tearing down MHI and freeing DMA contexts before the SSR reset_work has completed, producing a NULL pointer dereference in mhi_deinit_dev_ctxt() and a full kernel panic. No public proof-of-concept exists, and the timing race makes deliberate exploitation highly impractical.