CVE-2026-63822

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double-free issue exists in the ath11k Wi-Fi driver. When a firmware-related initialization error occurs, the buffers dp->tx ring[i].tx status are released. If the device is subsequently unbound via ath11k pci, these buffers are released a second time, triggering a warning in free large kmalloc(). This behavior is consistently reproducible in virtual machine environments where MSI (Message Signaled Interrupts) addressing initialization fails. The flaw involves the following function sequence: ath11k pci remove() calls ath11k core deinit(), which calls ath11k dp free(), leading to the double-free in free large kmalloc().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.