CVE-2026-63822 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix warning when unbinding
If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released.
However this is released again when the device is unbinded (ath11k_pci), and we get: WARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90 Call Trace: free_large_kmalloc ath11k_dp_free ath11k_core_deinit ath11k_pci_remove ...
The issue is always reproducible from a VM because the MSI addressing initialization is failing.
In order to fix the issue, just set the buffers to NULL after releasing in order to avoid the double free.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability represents a critical memory management flaw in the Linux kernel's ath11k wireless driver implementation that manifests as a double free condition during device unbinding operations. The issue occurs within the Qualcomm QCA6174 and QCA6274 family of wireless network adapters that utilize the ath11k driver stack, specifically affecting systems where firmware initialization fails during the device setup process. When initialization encounters errors related to firmware loading or hardware configuration, the driver attempts to clean up allocated memory buffers through the dp->tx_ring[i].tx_status structure elements. However, this cleanup process does not properly account for subsequent unbinding operations that also attempt to free the same memory regions, resulting in a kernel warning message indicating a double free error in the SLUB memory allocator.
The technical root cause stems from improper resource management within the driver's cleanup path where buffer pointers are not reset to NULL after initial deallocation. This memory management failure occurs in the ath11k_pci_remove function which handles device removal operations, specifically during the ath11k_core_deinit process that orchestrates the complete shutdown sequence for the wireless device. The vulnerability is particularly concerning because it affects the core kernel memory subsystem through the mm/slub.c module, where the free_large_kmalloc function detects and reports the invalid memory deallocation attempt. The error path shows that the warning originates from CPU 0 with PID 6231, indicating a single-threaded execution context where the double free condition is detected by the kernel's memory management subsystem.
The operational impact of this vulnerability extends beyond simple kernel warnings to potentially destabilize system operations and create security implications through kernel memory corruption. When the device binding process fails during firmware initialization, the driver enters an inconsistent state where freed memory regions remain referenced in subsequent cleanup operations, which could lead to unpredictable behavior including system crashes, memory corruption, or even potential privilege escalation vectors. This issue is consistently reproducible within virtual machine environments due to specific MSI addressing initialization failures that trigger the problematic code path, making it particularly relevant for cloud computing and containerized environments where VM-based wireless networking is common. The vulnerability affects the core networking functionality of affected systems and represents a failure in proper resource lifecycle management during error conditions.
Mitigation strategies should focus on implementing proper null pointer assignment after memory deallocation to prevent subsequent free operations from attempting to release already freed memory regions. The fix requires modifying the driver's cleanup code path to set dp->tx_ring[i].tx_status pointers to NULL immediately after the initial memory release operation, ensuring that subsequent unbinding operations do not attempt duplicate free operations. This approach aligns with established security practices for preventing double free vulnerabilities and follows the principle of defensive programming by ensuring proper resource state management throughout all execution paths. The solution should be implemented in the device initialization failure handling code to ensure that all cleanup paths properly account for previously released resources, thereby maintaining kernel stability and preventing potential exploitation through memory corruption attacks.
This vulnerability maps directly to CWE-415: Double Free and CWE-416: Use After Free within the Common Weakness Enumeration catalog, representing a classic memory management error pattern that can lead to system instability. From an ATT&CK framework perspective, this issue could potentially be leveraged as a privilege escalation vector through kernel memory corruption, falling under the T1068: Exploitation for Privilege Escalation tactic category. The vulnerability demonstrates poor error handling and resource management practices that are commonly exploited in kernel-level attacks, making it particularly concerning for enterprise environments where wireless networking infrastructure is critical. Proper implementation of the fix would involve comprehensive testing of both normal operation and error handling paths to ensure no regressions occur in device functionality while maintaining system stability during failure conditions.