CVE-2026-98307

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()

When mac80211 removes a sta, it calls .sta_state() which in turn calls

ath11k_mac_station_remove(). In that function we clean up both peers &

arsta related resources.

But when the firmware crashes, ath11k calls ieee80211_restart_hw(), which

assumes that all driver related resources are cleaned up beforehand. This

cleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not

in fact free arsta->rx_stats / tx_stats.

Extract the arsta cleanup from ath11k_mac_station_remove() into a

new ath11k_mac_station_cleanup() and call it from both there and

ath11k_mac_peer_cleanup_all().

This should handle kmemleaks reports like:

unreferenced object 0xffffff801ae66400 (size 1024):

comm "hostapd", pid 1306, jiffies 4295011565

hex dump (first 32 bytes):

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00 00 00 00 00 00 00 00 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References