CVE-2026-98307

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98307", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.338Z", "datePublished": "2026-10-06T08:46:04.301Z", "dateUpdated": "2026-10-19T09:17:17.992Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:17.992Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()\n\nWhen mac80211 removes a sta, it calls .sta_state() which in turn calls\nath11k_mac_station_remove(). In that function we clean up both peers &\narsta related resources.\n\nBut when the firmware crashes, ath11k calls ieee80211_restart_hw(), which\nassumes that all driver related resources are cleaned up beforehand. This\ncleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not\nin fact free arsta->rx_stats / tx_stats.\n\nExtract the arsta cleanup from ath11k_mac_station_remove() into a\nnew ath11k_mac_station_cleanup() and call it from both there and\nath11k_mac_peer_cleanup_all().\n\nThis should handle kmemleaks reports like:\n\tunreferenced object 0xffffff801ae66400 (size 1024):\n\t comm \"hostapd\", pid 1306, jiffies 4295011565\n\t hex dump (first 32 bytes):\n\t 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n\t 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n\t backtrace (crc d61c08ec):\n\t kmemleak_alloc+0x3c/0x50\n\t __kmalloc_cache_noprof+0x2b0/0x3e0\n\t ath11k_mac_op_sta_state+0x1dc/0xb10\n\t drv_sta_state+0xac/0x6f8\n\t sta_info_insert_rcu+0x314/0x5e0\n\t sta_info_insert+0x14/0x38\n\t ieee80211_add_station+0x10c/0x1a0\n\t nl80211_new_station+0x3e8/0x680\n\t genl_family_rcv_msg_doit+0xc0/0x120\n\t genl_rcv_msg+0x1b4/0x258\n\t netlink_rcv_skb+0x4c/0x108\n\t genl_rcv+0x38/0x60\n\t netlink_unicast+0x190/0x278\n\t netlink_sendmsg+0x15c/0x370\n\t ____sys_sendmsg+0x120/0x290\n\t ___sys_sendmsg+0x70/0xa0\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/mac.c"], "versions": [{"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "c4108dce0838ec7d38d782f76f9c007cfe2fff45", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "57bc3cd46458eafa1c38e3044a61b7399cde7642", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "820b8cff81c796ba20573e04722ab62500713f97", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/mac.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c4108dce0838ec7d38d782f76f9c007cfe2fff45"}, {"url": "https://git.kernel.org/stable/c/57bc3cd46458eafa1c38e3044a61b7399cde7642"}, {"url": "https://git.kernel.org/stable/c/be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac"}, {"url": "https://git.kernel.org/stable/c/820b8cff81c796ba20573e04722ab62500713f97"}], "title": "wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/mac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c4108dce0838ec7d38d782f76f9c007cfe2fff45", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "57bc3cd46458eafa1c38e3044a61b7399cde7642", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "820b8cff81c796ba20573e04722ab62500713f97", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/mac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()\n\nWhen mac80211 removes a sta, it calls .sta_state() which in turn calls\nath11k_mac_station_remove(). In that function we clean up both peers &\narsta related resources.\n\nBut when the firmware crashes, ath11k calls ieee80211_restart_hw(), which\nassumes that all driver related resources are cleaned up beforehand. This\ncleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not\nin fact free arsta->rx_stats / tx_stats.\n\nExtract the arsta cleanup from ath11k_mac_station_remove() into a\nnew ath11k_mac_station_cleanup() and call it from both there and\nath11k_mac_peer_cleanup_all().\n\nThis should handle kmemleaks reports like:\n\tunreferenced object 0xffffff801ae66400 (size 1024):\n\t comm \"hostapd\", pid 1306, jiffies 4295011565\n\t hex dump (first 32 bytes):\n\t 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n\t 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n\t backtrace (crc d61c08ec):\n\t kmemleak_alloc+0x3c/0x50\n\t __kmalloc_cache_noprof+0x2b0/0x3e0\n\t ath11k_mac_op_sta_state+0x1dc/0xb10\n\t drv_sta_state+0xac/0x6f8\n\t sta_info_insert_rcu+0x314/0x5e0\n\t sta_info_insert+0x14/0x38\n\t ieee80211_add_station+0x10c/0x1a0\n\t nl80211_new_station+0x3e8/0x680\n\t genl_family_rcv_msg_doit+0xc0/0x120\n\t genl_rcv_msg+0x1b4/0x258\n\t netlink_rcv_skb+0x4c/0x108\n\t genl_rcv+0x38/0x60\n\t netlink_unicast+0x190/0x278\n\t netlink_sendmsg+0x15c/0x370\n\t ____sys_sendmsg+0x120/0x290\n\t ___sys_sendmsg+0x70/0xa0\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1"}], "id": "CVE-2026-98307", "lastModified": "2026-10-19T10:18:32.737", "metrics": {}, "published": "2026-10-06T09:18:21.950", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57bc3cd46458eafa1c38e3044a61b7399cde7642"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/820b8cff81c796ba20573e04722ab62500713f97"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c4108dce0838ec7d38d782f76f9c007cfe2fff45"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()", "id": "2546434", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546434"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()\nWhen mac80211 removes a sta, it calls .sta_state() which in turn calls\nath11k_mac_station_remove(). In that function we clean up both peers &\narsta related resources.\nBut when the firmware crashes, ath11k calls ieee80211_restart_hw(), which\nassumes that all driver related resources are cleaned up beforehand. This\ncleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not\nin fact free arsta->rx_stats / tx_stats.\nExtract the arsta cleanup from ath11k_mac_station_remove() into a\nnew ath11k_mac_station_cleanup() and call it from both there and\nath11k_mac_peer_cleanup_all().\nThis should handle kmemleaks reports like:\nunreferenced object 0xffffff801ae66400 (size 1024):\ncomm \"hostapd\", pid 1306, jiffies 4295011565\nhex dump (first 32 bytes):\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\nbacktrace (crc d61c08ec):\nkmemleak_alloc+0x3c/0x50\n__kmalloc_cache_noprof+0x2b0/0x3e0\nath11k_mac_op_sta_state+0x1dc/0xb10\ndrv_sta_state+0xac/0x6f8\nsta_info_insert_rcu+0x314/0x5e0\nsta_info_insert+0x14/0x38\nieee80211_add_station+0x10c/0x1a0\nnl80211_new_station+0x3e8/0x680\ngenl_family_rcv_msg_doit+0xc0/0x120\ngenl_rcv_msg+0x1b4/0x258\nnetlink_rcv_skb+0x4c/0x108\ngenl_rcv+0x38/0x60\nnetlink_unicast+0x190/0x278\nnetlink_sendmsg+0x15c/0x370\n____sys_sendmsg+0x120/0x290\n___sys_sendmsg+0x70/0xa0\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1", "A flaw was found in the Linux kernel's ath11k wireless driver. This vulnerability can lead to a Denial of Service (DoS) through memory exhaustion. When recovering from a wireless firmware crash, the driver fails to free memory allocated for station statistics. An attacker or anomalous condition capable of triggering repeated firmware restarts can exploit this issue to progressively leak kernel memory, ultimately degrading performance or crashing the system."], "name": "CVE-2026-98307", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98307\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98307\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98307.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d5c65159f2895379e11ca13f62feabe93278985d,c4108dce0838ec7d38d782f76f9c007cfe2fff45)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d5c65159f2895379e11ca13f62feabe93278985d,57bc3cd46458eafa1c38e3044a61b7399cde7642)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d5c65159f2895379e11ca13f62feabe93278985d,be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d5c65159f2895379e11ca13f62feabe93278985d,820b8cff81c796ba20573e04722ab62500713f97)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T13:15:16.590951+00:00", "updated": "2026-10-11T19:00:14.126923+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}