CVE-2026-63822: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63822 Overview

CVE-2026-63822 is a double free vulnerability in the Linux kernel ath11k Wi-Fi driver. When firmware initialization fails, the driver releases the dp->tx_ring[i].tx_status buffers but does not clear the pointers. During subsequent PCI device unbind through ath11k_pci_remove, the same buffers are released a second time, triggering a WARNING in free_large_kmalloc at mm/slub.c:4368. The condition is reliably reproducible inside virtual machines because MSI addressing initialization fails in that environment. The fix sets the freed buffers to NULL after release to prevent the double free.

Critical Impact
Double free of tx_status buffers during ath11k driver unbind can corrupt kernel slab state, producing warnings and potentially destabilizing systems running Qualcomm ath11k Wi-Fi hardware, particularly in virtualized environments.

Affected Products

Linux kernel ath11k Wi-Fi driver
Systems using Qualcomm ath11k PCI Wi-Fi chipsets
Virtual machines exposing ath11k devices where MSI initialization fails

Discovery Timeline

2026-07-19 - CVE-2026-63822 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63822

Vulnerability Analysis

The vulnerability resides in the data path (DP) teardown logic of the ath11k driver. During firmware-related initialization, the driver allocates per-ring tx_status buffers referenced by dp->tx_ring[i].tx_status. When initialization fails partway through, the error handling path releases these buffers to recover resources.

The pointers are not reset to NULL after release. When the PCI device is later unbound, ath11k_pci_remove invokes ath11k_core_deinit, which calls ath11k_dp_free. That function iterates the tx rings and frees tx_status again on stale pointers. The kernel slab allocator detects the invalid free and emits a warning from free_large_kmalloc.

Root Cause

The root cause is missing pointer nullification after buffer release in the initialization error path. Freed memory references remain in the dp->tx_ring[] structure, and no guard exists in ath11k_dp_free to skip already-released buffers. This is a classic double free pattern [CWE-415] triggered by partial-initialization rollback interacting with normal teardown.

Attack Vector

The issue is triggered by an initialization failure followed by device unbind. In virtualized environments, MSI addressing initialization consistently fails, making the double free trivially reproducible. Exploitation requires local access sufficient to load, initialize, or unbind the ath11k_pci driver. The observable outcome is a kernel warning and slab allocator state disturbance during driver removal; broader memory corruption impact depends on allocator behavior between the first free and the second.

See the upstream fix commits for technical details, including Kernel Git Commit 051f954 and Kernel Git Commit e569a5c.

Detection Methods for CVE-2026-63822

Indicators of Compromise

Kernel log entries containing WARNING: CPU: 0 PID: <pid> at mm/slub.c:4368 free_large_kmalloc+0x57/0x90
Call trace showing free_large_kmalloc followed by ath11k_dp_free, ath11k_core_deinit, and ath11k_pci_remove
ath11k firmware initialization failure messages preceding driver unbind events

Detection Strategies

Monitor dmesg and journalctl -k output for the free_large_kmalloc warning signature associated with ath11k_dp_free.
Correlate ath11k initialization failures with subsequent ath11k_pci_remove invocations in kernel logs.
Track kernel version and ath11k module version across the fleet to identify systems missing the upstream fix.

Monitoring Recommendations

Forward kernel logs to a centralized logging system and alert on ath11k_dp_free appearing in stack traces.
Baseline expected driver bind and unbind events on hosts with Qualcomm Wi-Fi hardware to surface anomalous initialization failures.
Audit virtualization hosts that pass through or emulate ath11k devices, since MSI failure reliably triggers this path.

How to Mitigate CVE-2026-63822

Immediate Actions Required

Update to a Linux kernel version that includes the upstream ath11k double free fix commits referenced in the NVD entry.
Avoid repeated bind and unbind cycles of the ath11k_pci driver on systems where firmware initialization is known to fail.
On virtualized hosts, disable passthrough of ath11k devices until the patched kernel is deployed if MSI initialization is unreliable.

Patch Information

The fix nullifies dp->tx_ring[i].tx_status after release so that ath11k_dp_free does not attempt a second free. Backports are available across multiple stable branches. Reference commits include Kernel Git Commit 051f954, Kernel Git Commit 0a946ab, Kernel Git Commit 0aa097a, Kernel Git Commit 318703b, Kernel Git Commit 40aa3c2, Kernel Git Commit 7b2e62b, Kernel Git Commit 8b7a26b, and Kernel Git Commit e569a5c.

Workarounds

Blacklist the ath11k_pci module on affected virtual machines where the driver is not required for operation.
Restrict privileges needed to bind, unbind, or reload kernel modules to trusted administrators only.
Reboot rather than repeatedly unbind the driver after an ath11k initialization failure to avoid triggering the double free path.

bash

# Blacklist ath11k_pci on affected virtual machines
echo "blacklist ath11k_pci" | sudo tee /etc/modprobe.d/blacklist-ath11k.conf
sudo update-initramfs -u