CVE-2026-74366: wifi: ath12k: fix NULL deref in change_sta_links for unready link
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix NULL deref in changestalinks for unready link
ieee80211setactivelinks() calls ieee80211linkusechannel() for each newly-added link and WARNONONCE()s if it fails. The call uses assignonfailure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drvassignvifchanctx() is never reached. Since ath12kmacvdevcreate() is only called from that path, arvif->iscreated remains false and arvif->ar remains NULL for the failed link.
The subsequent drvchangestalinks() call reaches ath12kmacopchangestalinks(), which allocates an arsta and sets ahsta->linksmap |= BIT(linkid) for the broken link before checking whether the link is ready. When the vdev was never created, only stationadd() is skipped, but the link remains in linksmap.
Any subsequent operation iterating linksmap and dereferencing arvif->ar without a NULL check will crash. Two observed examples are NULL deref in ath12kmacmlstationremove() on disconnect and in ath12kmacopsetkey() when wpasupplicant installs PTK keys.
BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacstationpostremove+0x40/0xe8 [ath12k] Call trace: ath12kmacstationpostremove+0x40/0xe8 [ath12k] ath12kmacopstastate+0xb60/0x1720 [ath12k] drvstastate+0x100/0xbd8 [mac80211] stainfodestroypart2+0x148/0x178 [mac80211] ieee80211setdisassoc+0x500/0x678 [mac80211]
BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] Call trace: ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] drvsetkey+0x70/0x100 [mac80211] ieee80211keyenablehwaccel+0x78/0x260 [mac80211] ieee80211addkey+0x16c/0x2ac [mac80211] nl80211newkey+0x138/0x280 [cfg80211]
Fix this by checking arvif->iscreated before calling ath12kmacallocassignlinksta(). This prevents the broken link from entering linksmap, so all subsequent operations iterating the bitmap are protected. The reliability of arvif->iscreated across all error paths is ensured by the preceding patch.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPLV1.0V2.0SILICONZ-1.115823.3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix for CVE content described as: "wifi: ath12k: fix NULL deref in change_sta_links for unready link" by adding a guard so that code checks whether arvif->is_created before calling the path that dereferences arvif/ar (e.g., before drv_change_sta_links() and before iterating links_map that may include an unready/broken link).
Linux kernel (ath12k/mac80211) arvif->is_created check before drv_change_sta_links()/links_map iteration = enabled