{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()  When mac80211 removes a sta, it calls .sta_state() which in turn calls ath11k_mac_station_remove(). In that function we clean up both peers \u0026 arsta related resources.  But when the firmware crashes, ath11k calls ieee80211_restart_hw(), which assumes that all driver related resources are cleaned up beforehand. This cleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not in fact free arsta-\u003erx_stats / tx_stats.  Extract the arsta cleanup from ath11k_mac_station_remove() into a new ath11k_mac_station_cleanup() and call it from both there and ath11k_mac_peer_cleanup_all().  This should handle kmemleaks reports like: \tunreferenced object 0xffffff801ae66400 (size 1024): \t  comm \"hostapd\", pid 1306, jiffies 4295011565 \t  hex dump (first 32 bytes): \t    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ \t    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ \t  backtrace (crc d61c08ec): \t    kmemleak_alloc+0x3c/0x50 \t    __kmalloc_cache_noprof+0x2b0/0x3e0 \t    ath11k_mac_op_sta_state+0x1dc/0xb10 \t    drv_sta_state+0xac/0x6f8 \t    sta_info_insert_rcu+0x314/0x5e0 \t    sta_info_insert+0x14/0x38 \t    ieee80211_add_station+0x10c/0x1a0 \t    nl80211_new_station+0x3e8/0x680 \t    genl_family_rcv_msg_doit+0xc0/0x120 \t    genl_rcv_msg+0x1b4/0x258 \t    netlink_rcv_skb+0x4c/0x108 \t    genl_rcv+0x38/0x60 \t    netlink_unicast+0x190/0x278 \t    netlink_sendmsg+0x15c/0x370 \t    ____sys_sendmsg+0x120/0x290 \t    ___sys_sendmsg+0x70/0xa0  Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1",
  "id": "DEBIAN-CVE-2026-98307",
  "modified": "2026-10-07T04:47:35.899988301Z",
  "published": "2026-10-06T09:18:21.950Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98307"
    }
  ],
  "upstream": [
    "CVE-2026-98307"
  ]
}