CVE-2026-46248
Memory Leak in ath12k WiFi Driver
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's wifi driver ath12k. It occurs when an arvif (a virtual interface) is initialized in non-AP STA mode but the MLO connection preparation fails before the arvif is fully created (arvif->is_created remains false). In this error state, the code attempts to delete all links, but link deletion only happens if arvif->is_created is true. As a result, a stale link mapping remains in ahvif->links_map for an arvif that was initialized but not created.
When a new arvif is initialized with the same link ID, this stale mapping causes a warning (WARN_ON) in the kernel, indicating an unexpected state or potential issue in the wireless driver.
The fix involves unassigning the link vif and clearing the ahvif->links_map if the arvif is only initialized but not created, preventing stale entries and the resulting warnings.
How can this vulnerability impact me? :
This vulnerability can lead to stale link mappings in the wireless driver, which trigger kernel warnings and potentially unstable behavior in the wifi subsystem.
While the description does not explicitly mention remote code execution or privilege escalation, the presence of stale mappings and kernel warnings could cause instability or unexpected behavior in wireless connectivity, possibly affecting system reliability.
Users relying on affected Linux kernel versions with the ath12k driver might experience wifi connection issues or kernel warnings that could impact network performance or system logs.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for specific warning messages related to the ath12k wireless driver.
- Look for the warning message: "WARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k], CPU#X: wpa_supplicant/YYY" in the kernel logs.
- Use the command: dmesg | grep ath12k_mac_op_change_vif_links to filter kernel messages related to this issue.
- Check system logs with: journalctl -k | grep ath12k_mac_op_change_vif_links
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the issue has been fixed.
The fix involves clearing stale link mappings in the ath12k driver when an arvif is initialized but not created, preventing the stale entry from causing warnings or potential issues.
Until the update is applied, monitor for the warning messages and consider restarting the wireless interface or system to clear stale states.