In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix warning when unbinding

If there is an error during some initialization related to firmware,
the buffers dp->tx_ring[i].tx_status are released.
However this is released again when the device is unbinded (ath11k_pci),
and we get:
WARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90
Call Trace:
free_large_kmalloc
ath11k_dp_free
ath11k_core_deinit
ath11k_pci_remove
...

The issue is always reproducible from a VM because the MSI addressing
initialization is failing.

In order to fix the issue, just set the buffers to NULL after releasing in
order to avoid the double free.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00165.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
d5c65159f2895379e11ca13f62feabe93278985d affected < e569a5cb401a267168621aa9a1e7f07fcc9612c3
d5c65159f2895379e11ca13f62feabe93278985d affected < 0aa097a370277deab5337030b9e2d395742f469c
d5c65159f2895379e11ca13f62feabe93278985d affected < 0a946abb82f29abe9a15173b707a449cb039b43e
d5c65159f2895379e11ca13f62feabe93278985d affected < 318703b6f71d1a29ee0ac46c32a38f7734d4cfb2
d5c65159f2895379e11ca13f62feabe93278985d affected < 7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13
d5c65159f2895379e11ca13f62feabe93278985d affected < 40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0a
d5c65159f2895379e11ca13f62feabe93278985d affected < 051f954b94479d72222c9fbc82a3eef4777bca01
d5c65159f2895379e11ca13f62feabe93278985d affected < 8b7a26b6681922a38cd5a7829ace61f8e54df9b7
Linux Linux affected
Version Status Constraints
5.6 affected —
0 unaffected < 5.6
5.10.260 unaffected ≤ 5.10.*
5.15.211 unaffected ≤ 5.15.*
6.1.177 unaffected ≤ 6.1.*
6.6.144 unaffected ≤ 6.6.*
6.12.95 unaffected ≤ 6.12.*
6.18.38 unaffected ≤ 6.18.*
7.1.3 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/051f954b94479d72222c9fbc82a3eef4777bca01 cve-icon
https://git.kernel.org/stable/c/0a946abb82f29abe9a15173b707a449cb039b43e cve-icon
https://git.kernel.org/stable/c/0aa097a370277deab5337030b9e2d395742f469c cve-icon
https://git.kernel.org/stable/c/318703b6f71d1a29ee0ac46c32a38f7734d4cfb2 cve-icon
https://git.kernel.org/stable/c/40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0a cve-icon
https://git.kernel.org/stable/c/7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13 cve-icon
https://git.kernel.org/stable/c/8b7a26b6681922a38cd5a7829ace61f8e54df9b7 cve-icon
https://git.kernel.org/stable/c/e569a5cb401a267168621aa9a1e7f07fcc9612c3 cve-icon
https://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-63822-fdd2@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-63822 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-63822 cve-icon
History

Tue, 21 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 19 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is unbinded (ath11k_pci), and we get: WARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90 Call Trace: free_large_kmalloc ath11k_dp_free ath11k_core_deinit ath11k_pci_remove ... The issue is always reproducible from a VM because the MSI addressing initialization is failing. In order to fix the issue, just set the buffers to NULL after releasing in order to avoid the double free.
Title wifi: ath11k: fix warning when unbinding
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T12:02:19.286Z

Reserved: 2026-07-19T07:54:57.014Z

Link: CVE-2026-63822

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63822 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses