CVE-2026-74366

Received Received - Intake

NULL Pointer Dereference in ath12k WiFi Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in change_sta_links for unready link _ieee80211_set_active_links() calls _ieee80211_link_use_channel() for each newly-added link and WARN_ON_ONCE()s if it fails. The call uses assign_on_failure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drv_assign_vif_chanctx() is never reached. Since ath12k_mac_vdev_create() is only called from that path, arvif->is_created remains false and arvif->ar remains NULL for the failed link. The subsequent drv_change_sta_links() call reaches ath12k_mac_op_change_sta_links(), which allocates an arsta and sets ahsta->links_map |= BIT(link_id) for the broken link before checking whether the link is ready. When the vdev was never created, only station_add() is skipped, but the link remains in links_map. Any subsequent operation iterating links_map and dereferencing arvif->ar without a NULL check will crash. Two observed examples are NULL deref in ath12k_mac_ml_station_remove() on disconnect and in ath12k_mac_op_set_key() when wpa_supplicant installs PTK keys. BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12k_mac_station_post_remove+0x40/0xe8 [ath12k] Call trace: ath12k_mac_station_post_remove+0x40/0xe8 [ath12k] ath12k_mac_op_sta_state+0xb60/0x1720 [ath12k] drv_sta_state+0x100/0xbd8 [mac80211] __sta_info_destroy_part2+0x148/0x178 [mac80211] ieee80211_set_disassoc+0x500/0x678 [mac80211] BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12k_mac_op_set_key+0x1f8/0x2c0 [ath12k] Call trace: ath12k_mac_op_set_key+0x1f8/0x2c0 [ath12k] drv_set_key+0x70/0x100 [mac80211] ieee80211_key_enable_hw_accel+0x78/0x260 [mac80211] ieee80211_add_key+0x16c/0x2ac [mac80211] nl80211_new_key+0x138/0x280 [cfg80211] Fix this by checking arvif->is_created before calling ath12k_mac_alloc_assign_link_sta(). This prevents the broken link from entering links_map, so all subsequent operations iterating the bitmap are protected. The reliability of arvif->is_created across all error paths is ensured by the preceding patch. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74366

EUVD

EUVD-2026-59513

Affected Vendors & Products

Vendor	Product	Version / Range
qualcomm	ath12k	From 1.115823.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's ath12k Wi-Fi driver. It occurs when a Wi-Fi link fails to initialize properly but is still marked as active in the system. The driver attempts to use this uninitialized link, leading to a crash when it tries to access memory that doesn't exist.

Detection Guidance

This vulnerability is specific to the Linux kernel's ath12k WiFi driver and may not have direct detection commands. Monitor kernel logs for NULL pointer dereference errors related to ath12k_mac_station_post_remove or ath12k_mac_op_set_key. Check for crashes during WiFi disconnections or key installations using dmesg | grep ath12k or journalctl -k | grep ath12k.

Impact Analysis

This vulnerability can cause system crashes (kernel panics) when using affected Wi-Fi hardware. Users may experience sudden system freezes or reboots when connecting to Wi-Fi networks or during network operations. It specifically affects systems using Qualcomm's ath12k Wi-Fi chipset.

Compliance Impact

This vulnerability is a kernel NULL pointer dereference in the Linux ath12k WiFi driver. It does not directly relate to data privacy or security controls required by GDPR or HIPAA. The issue causes system crashes but does not expose or leak sensitive data.

Mitigation Strategies

Apply the kernel patch fixing the NULL dereference in ath12k. Update to a kernel version containing the fix. If immediate patching is not possible, disable the ath12k driver or avoid using affected WiFi features until patched.

Hi! I’m here to help you understand CVE-2026-74366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70