CVE-2026-98936 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: reset ar->num_stations on hardware start
When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num_stations' in 'struct ath11k' that did not get reset properly in this case. In ath11k_mac_op_start(), it was indeed the only accounting var that did not get reset so let's clear it too.
This avoids problems like those:
[1248828.088023] WARNING: CPU: 0 PID: 12281 at net/mac80211/util.c:1682 ieee80211_reconfig_stations+0x98/0xc0
[1248828.088115] Call trace:
[1248828.088116] ieee80211_reconfig_stations+0x98/0xc0 (P)
[1248828.088119] ieee80211_reconfig+0x774/0x1438
[1248828.088123] ieee80211_restart_work+0x10c/0x178
[1248828.088127] process_one_work+0x178/0x3c0
[1248828.088130] worker_thread+0x280/0x440
[1248828.088133] kthread+0xe0/0xf8
[1248828.088137] ret_from_fork+0x10/0x20
[1248828.088141] ---[ end trace 0000000000000000 ]---
[1248836.686604] ath11k_pci 0000:04:00.0: refusing to associate station: too many connected already (128)
[1248836.686609] ath11k_pci 0000:04:00.0: Failed to add station: xx:xx:xx:xx:xx:xx for VDEV: 1
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel's ath11k wireless driver represents a state management flaw that occurs during hardware restart operations, specifically affecting the accounting of connected stations and mesh peers. The core technical issue lies within the initialization sequence triggered by multiple hardware resets. When the network interface undergoes a reconfiguration or restart cycle, various internal counters are reset to their default states to ensure clean operation for subsequent connections. However, the num_stations field within the ath11k driver structure was inadvertently omitted from this reset process. This oversight results in the counter retaining its previous value rather than being cleared to zero, creating a discrepancy between the actual number of active stations and the kernel's internal tracking variable.
This state inconsistency leads directly to operational failures where the wireless interface refuses new association requests from client devices or mesh peers. The driver checks the num_stations count against a predefined maximum limit, typically set at one hundred twenty-eight connections for this hardware variant. Because the counter is not reset after a restart, it may still reflect the high number of stations present before the crash or reboot occurred. Consequently, even if no actual clients are currently connected to the interface, the driver perceives that the station capacity has been reached and rejects new connection attempts with error messages indicating too many connected devices already exist. This effectively renders the wireless adapter unable to accept any new connections until a full system reboot clears the memory state or the specific counter is manually corrected through other means.
The impact of this vulnerability is primarily localized to service availability rather than security exploitation in the traditional sense, although it can be leveraged for denial-of-service scenarios if an attacker can induce repeated hardware restarts. The operational consequence is a complete loss of connectivity for new clients attempting to join the network after any instance of driver or hardware reset. This affects both standard infrastructure mode connections and mesh networking topologies, disrupting network stability in environments where automatic reconnection or failover mechanisms trigger frequent interface resets. The kernel logs explicitly show warnings related to ieee80211_reconfig_stations followed by refusal messages from the ath11k_pci driver, confirming that the failure originates from this internal accounting error within the mac80211 subsystem interaction with the hardware-specific driver logic.
From a classification perspective, this issue aligns with CWE-369, which describes Service Interrupt due to Shared Resource Error, as the shared resource is the station connection limit managed by the driver state machine. It also relates to CWE-457, Use of Uninitialized Variable, in the broader sense that the variable was not properly initialized or reset for its current operational context. In terms of MITRE ATT&CK mapping, this behavior could be associated with T1499 Endpoint Denial of Service if an adversary were able to trigger repeated hardware resets to exhaust connection slots without actually connecting any clients, thereby denying service to legitimate users. The fix involves modifying the ath11k_mac_op_start function to explicitly clear the num_stations variable during the hardware start sequence, ensuring that the accounting state accurately reflects a fresh initialization cycle and allowing new stations to associate normally after subsequent restarts.