CVE-2026-74554
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is wrong: dp_peer->peer_id for an MLO peer always carries the ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS (256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The intended bitmap entry also never gets cleared, so subsequent ath12k_peer_ml_alloc() calls eventually run out of IDs. The ID without the VALID bit is what ath12k_peer_ml_alloc() returned and is stored in ahsta->ml_peer_id. Use that instead. While there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so the bitmap and ahsta->ml_peer_id stay in sync. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74554
EUVD
EUVD-2026-59619

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory corruption vulnerability in the Linux kernel's ath12k WiFi driver. It occurs when clearing a peer ID slot in a bitmap using an incorrect index that includes a valid bit flag. This causes the index to exceed the bitmap's size, corrupting adjacent memory and preventing proper peer ID allocation.

Detection Guidance

This vulnerability is specific to the Linux kernel's ath12k Wi-Fi driver and requires kernel-level inspection. Detection involves checking for kernel logs or crashes related to ath12k or memory corruption. Commands like dmesg | grep ath12k or journalctl -k | grep ath12k may reveal errors. However, no direct detection commands are provided in the context.

Impact Analysis

This could lead to system instability, crashes, or potential privilege escalation if exploited. It may cause WiFi functionality to fail as peer IDs become exhausted, disrupting network connectivity.

Mitigation Strategies

Update the Linux kernel to a patched version where this vulnerability is resolved. The fix involves correcting the peer ID handling in the ath12k driver. Check your distribution's security updates or kernel release notes for the fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart