CVE-2026-98936

Source
https://cve.org/CVERecord?id=CVE-2026-98936
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98936.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-98936
Downstream
Related
Published
2026-10-23T12:11:48Z
Modified
2026-11-04T14:27:24Z
Summary
wifi: ath11k: reset ar->num_stations on hardware start
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: reset ar->num_stations on hardware start

When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num_stations' in 'struct ath11k' that did not get reset properly in this case. In ath11k_mac_op_start(), it was indeed the only accounting var that did not get reset so let's clear it too.

This avoids problems like those:

[1248828.088023] WARNING: CPU: 0 PID: 12281 at net/mac80211/util.c:1682 ieee80211_reconfig_stations+0x98/0xc0
[1248828.088115] Call trace:
[1248828.088116]  ieee80211_reconfig_stations+0x98/0xc0 (P)
[1248828.088119]  ieee80211_reconfig+0x774/0x1438
[1248828.088123]  ieee80211_restart_work+0x10c/0x178
[1248828.088127]  process_one_work+0x178/0x3c0
[1248828.088130]  worker_thread+0x280/0x440
[1248828.088133]  kthread+0xe0/0xf8
[1248828.088137]  ret_from_fork+0x10/0x20
[1248828.088141] ---[ end trace 0000000000000000 ]---
[1248836.686604] ath11k_pci 0000:04:00.0: refusing to associate station: too many connected already (128)
[1248836.686609] ath11k_pci 0000:04:00.0: Failed to add station: xx:xx:xx:xx:xx:xx for VDEV: 1

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98936.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d5c65159f2895379e11ca13f62feabe93278985d
Fixed
302b622d5f3c9ef5efa36e41e69d278599265cfc
Fixed
5f814ca9a68fd12a51fe82c36a4a876f5b8329f1
Fixed
a78f2d082f72e3c140c4542cade7f7f56f3cc62d
Fixed
60142eb2afda34508e640a3ff2a54c90e51525cc
Fixed
c3ac51701e925e8d50479ae2fddca51a09f636e8
Fixed
9a9467f7cc633b31e4c34a2c56aa095e0c3fa853
Fixed
c27779d3679c695674747744390f97a5424a0dc8
Fixed
7e0ad05ebc72fffba2bdf2400400902d94ed7272

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98936.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.6.0
Fixed
5.10.273
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.224
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.191
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.113
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.56
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.10

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98936.json"