{"id":"CVE-2026-98936","kind":"vulnerability","aliases":["CVE-2026-98936"],"related":[],"title":"Linux kernel: ath11k Wi-Fi driver stops accepting stations after restart","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: reset ar->num_stations on hardware start\n\nWhen (multiple) hw restart occurs, we end up in a situation where we\ncannot accept new stations / mesh peers. This seems to be the\n'num_stations' in 'struct ath11k' that did not get reset properly in\nthis case. In ath11k_mac_op_start(), it was indeed the only accounting var\nthat did not get reset so let's clear it too.\n\nThis avoids problems like those:\n\n\t[1248828.088023] WARNING: CPU: 0 PID: 12281 at net/mac80211/util.c:1682 ieee80211_reconfig_stations+0x98/0xc0\n\t[1248828.088115] Call trace:\n\t[1248828.088116]  ieee80211_reconfig_stations+0x98/0xc0 (P)\n\t[1248828.088119]  ieee80211_reconfig+0x774/0x1438\n\t[1248828.088123]  ieee80211_restart_work+0x10c/0x178\n\t[1248828.088127]  process_one_work+0x178/0x3c0\n\t[1248828.088130]  worker_thread+0x280/0x440\n\t[1248828.088133]  kthread+0xe0/0xf8\n\t[1248828.088137]  ret_from_fork+0x10/0x20\n\t[1248828.088141] ---[ end trace 0000000000000000 ]---\n\t[1248836.686604] ath11k_pci 0000:04:00.0: refusing to associate station: too many connected already (128)\n\t[1248836.686609] ath11k_pci 0000:04:00.0: Failed to add station: xx:xx:xx:xx:xx:xx for VDEV: 1\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1","summary":"After repeated hardware restarts, the ath11k Wi-Fi driver keeps a stale station counter, so it refuses new clients and mesh peers. The sources describe a kernel warning and a refused-association error, with no sign of code execution or data theft.","severity":"low","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ath11k","linux-kernel","runtime","self-hosted","wifi"],"not_affected_if":["no-ath11k-hardware"],"how_to_check":"- Look for `refusing to associate station: too many connected already` in the kernel log (`dmesg | grep ath11k`)\n- Check the kernel version with `uname -r` and whether it includes the ath11k fix\n- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit 'wifi: ath11k: reset ar->num_stations on hardware start' (version unknown from sources)\n- unknown","status":"open","published_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:07+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:58:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'wifi: ath11k: reset ar->num_stations on hardware start' (version unknown from sources)\n- unknown","reach":"network","title":"Linux kernel: ath11k Wi-Fi driver stops accepting stations after restart","impact":"low","summary":"After repeated hardware restarts, the ath11k Wi-Fi driver keeps a stale station counter, so it refuses new clients and mesh peers. The sources describe a kernel warning and a refused-association error, with no sign of code execution or data theft.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","wifi","ath11k","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Wi-Fi station and mesh connections fail after repeated driver restarts","analyst_note":"","how_to_check":"- Look for `refusing to associate station: too many connected already` in the kernel log (`dmesg | grep ath11k`)\n- Check the kernel version with `uname -r` and whether it includes the ath11k fix\n- unknown","needs_analyst":false,"not_affected_if":["no-ath11k-hardware"],"who_is_affected":"Systems running Linux with an ath11k-based Qualcomm Wi-Fi adapter, such as the QCN9074 PCI card in the test notes, that perform repeated hardware restarts or act as access points or mesh nodes. Machines without ath11k hardware can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000665,"input_tokens":3856,"output_tokens":559,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':169C,178C,184C,190C,196C,201C,205C,211C '-01977':259C '-1':262C '-2026':14A,17A '-98936':15A,18A '0':160C '00.0':222C,237C '0000':220C,235C '0000000000000000':216C '04':221C,236C '1':250C '12281':162C '1248828.088023':157C '1248828.088115':171C '1248828.088116':174C '1248828.088119':181C '1248828.088123':186C '1248828.088127':192C '1248828.088130':198C '1248828.088133':203C '1248828.088137':207C '1248828.088141':213C '1248836.686604':217C '1248836.686609':232C '128':231C '1682':165C '2.9.0.1':258C 'accept':9A,105C 'account':139C 'add':240C 'alreadi':230C 'ar':85C 'associ':61B,225C 'ath11k':3A,19B,33B,83C,119C,130C,218C,233C 'avoid':153C 'call':172C 'cannot':104C 'case':128C 'clear':149C 'client':47B 'code':67B 'connect':229C 'counter':42B 'cpu':159C 'cve':13A,16A 'data':70B 'describ':53B 'driver':7A,37B 'end':97C,214C 'error':62B 'execut':68B 'fail':238C 'fi':6A,36B 'follow':77C 'fork':210C 'get':123C,144C 'hardwar':30B,89C 'host':26B 'hw':93C 'hw1.0':255C 'ieee80211':166C,175C,182C,187C 'inde':136C 'keep':38B 'kernel':2A,22B,55B,75C 'kthread':204C 'let':147C 'like':155C 'linux':1A,21B,74C 'linux-kernel':20B 'mac':131C 'mani':228C 'mesh':49B,108C 'multipl':92C 'net/mac80211/util.c':164C 'new':46B,106C 'num':86C,115C 'occur':95C 'one':194C 'op':132C 'p':180C 'pci':219C,234C,256C 'peer':50B,109C 'pid':161C 'problem':154C 'process':193C 'proper':125C 'qcahkswpl':260C 'qcn9074':254C 'reconfig':167C,176C,183C 'refus':45B,60B,223C 'refused-associ':59B 'repeat':29B 'reset':84C,124C,145C 'resolv':81C 'restart':12A,31B,94C,188C 'ret':208C 'runtim':23B 'seem':111C 'self':25B 'self-host':24B 'sign':65B 'siliconz':261C 'situat':101C 'sourc':52B 'stale':40B 'start':90C,133C 'station':10A,41B,87C,107C,116C,168C,177C,226C,241C 'stop':8A 'struct':118C 'test':252C 'tested-on':251C 'theft':71B 'thread':200C 'trace':173C,215C 'var':140C 'vdev':249C 'vulner':78C 'warn':56B,158C 'wi':5A,35B 'wi-fi':4A,34B 'wifi':27B,82C 'wlan.hk':257C 'work':189C,195C 'worker':199C 'x10/0x20':212C 'x10c/0x178':191C 'x178/0x3c0':197C 'x280/0x440':202C 'x774/0x1438':185C 'x98/0xc0':170C,179C 'xe0/0xf8':206C 'xx':242C,243C,244C,245C,246C,247C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux with an ath11k-based Qualcomm Wi-Fi adapter, such as the QCN9074 PCI card in the test notes, that perform repeated hardware restarts or act as access points or mesh nodes. Machines without ath11k hardware can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98936","severity":null,"published_at":"2026-10-23T13:17:14+00:00","modified_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98936","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98936","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}