SB20261023233 - Improper initialization in Linux kernel ath ath11k driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261023233

SB20261023233 - Improper initialization in Linux kernel ath ath11k driver

Published: October 23, 2026

Security Bulletin ID SB20261023233
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper initialization (CVE-ID: CVE-2026-98936)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to potentially cause a denial of service by preventing new wireless stations or mesh peers from connecting.

The vulnerability exists due to improper reinitialization of the station counter in the Linux kernel ath11k driver's ath11k_mac_op_start() function when restarting wireless hardware. A local user can potentially exploit stale station accounting after repeated hardware restarts to cause new station or mesh peer connections to be rejected because the driver incorrectly considers its station limit reached.


Remediation

Install update from vendor's website.

References