CVE-2026-98936

wifi: ath11k: reset ar->num_stations on hardware start

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: reset ar->num_stations on hardware start

When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num_stations' in 'struct ath11k' that did not get reset properly in this case. In ath11k_mac_op_start(), it was indeed the only accounting var that did not get reset so let's clear it too.

This avoids problems like those:

[1248828.088023] WARNING: CPU: 0 PID: 12281 at net/mac80211/util.c:1682 ieee80211_reconfig_stations+0x98/0xc0 [1248828.088115] Call trace: [1248828.088116] ieee80211_reconfig_stations+0x98/0xc0 (P) [1248828.088119] ieee80211_reconfig+0x774/0x1438 [1248828.088123] ieee80211_restart_work+0x10c/0x178 [1248828.088127] process_one_work+0x178/0x3c0 [1248828.088130] worker_thread+0x280/0x440 [1248828.088133] kthread+0xe0/0xf8 [1248828.088137] ret_from_fork+0x10/0x20 [1248828.088141] ---[ end trace 0000000000000000 ]--- [1248836.686604] ath11k_pci 0000:04:00.0: refusing to associate station: too many connected already (128) [1248836.686609] ath11k_pci 0000:04:00.0: Failed to add station: xx:xx:xx:xx:xx:xx for VDEV: 1

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d5c65159f2895379e11ca13f62feabe93278985d to before 302b622d5f3c9ef5efa36e41e69d278599265cfcAffected d5c65159f2895379e11ca13f62feabe93278985d to before 5f814ca9a68fd12a51fe82c36a4a876f5b8329f1Affected d5c65159f2895379e11ca13f62feabe93278985d to before a78f2d082f72e3c140c4542cade7f7f56f3cc62dAffected d5c65159f2895379e11ca13f62feabe93278985d to before 60142eb2afda34508e640a3ff2a54c90e51525ccAffected d5c65159f2895379e11ca13f62feabe93278985d to before c3ac51701e925e8d50479ae2fddca51a09f636e8Affected d5c65159f2895379e11ca13f62feabe93278985d to before 9a9467f7cc633b31e4c34a2c56aa095e0c3fa853Affected d5c65159f2895379e11ca13f62feabe93278985d to before c27779d3679c695674747744390f97a5424a0dc8Affected d5c65159f2895379e11ca13f62feabe93278985d to before 7e0ad05ebc72fffba2bdf2400400902d94ed7272Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

d5c65159f2895379e11ca13f62feabe93278985d to before 302b622d5f3c9ef5efa36e41e69d278599265cfcAffected
d5c65159f2895379e11ca13f62feabe93278985d to before 5f814ca9a68fd12a51fe82c36a4a876f5b8329f1Affected
d5c65159f2895379e11ca13f62feabe93278985d to before a78f2d082f72e3c140c4542cade7f7f56f3cc62dAffected
d5c65159f2895379e11ca13f62feabe93278985d to before 60142eb2afda34508e640a3ff2a54c90e51525ccAffected
d5c65159f2895379e11ca13f62feabe93278985d to before c3ac51701e925e8d50479ae2fddca51a09f636e8Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 9a9467f7cc633b31e4c34a2c56aa095e0c3fa853Affected
d5c65159f2895379e11ca13f62feabe93278985d to before c27779d3679c695674747744390f97a5424a0dc8Affected
d5c65159f2895379e11ca13f62feabe93278985d to before 7e0ad05ebc72fffba2bdf2400400902d94ed7272Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.