CVE-2026-74366: wifi: ath12k: fix NULL deref in change_sta_links for unready link
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix NULL deref in changestalinks for unready link
ieee80211setactivelinks() calls ieee80211linkusechannel() for each newly-added link and WARNONONCE()s if it fails. The call uses assignonfailure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drvassignvifchanctx() is never reached. Since ath12kmacvdevcreate() is only called from that path, arvif->iscreated remains false and arvif->ar remains NULL for the failed link.
The subsequent drvchangestalinks() call reaches ath12kmacopchangestalinks(), which allocates an arsta and sets ahsta->linksmap |= BIT(linkid) for the broken link before checking whether the link is ready. When the vdev was never created, only stationadd() is skipped, but the link remains in linksmap.
Any subsequent operation iterating linksmap and dereferencing arvif->ar without a NULL check will crash. Two observed examples are NULL deref in ath12kmacmlstationremove() on disconnect and in ath12kmacopsetkey() when wpasupplicant installs PTK keys.
BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacstationpostremove+0x40/0xe8 [ath12k] Call trace: ath12kmacstationpostremove+0x40/0xe8 [ath12k] ath12kmacopstastate+0xb60/0x1720 [ath12k] drvstastate+0x100/0xbd8 [mac80211] stainfodestroypart2+0x148/0x178 [mac80211] ieee80211setdisassoc+0x500/0x678 [mac80211]
BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] Call trace: ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] drvsetkey+0x70/0x100 [mac80211] ieee80211keyenablehwaccel+0x78/0x260 [mac80211] ieee80211addkey+0x16c/0x2ac [mac80211] nl80211newkey+0x138/0x280 [cfg80211]
Fix this by checking arvif->iscreated before calling ath12kmacallocassignlinksta(). This prevents the broken link from entering linksmap, so all subsequent operations iterating the bitmap are protected. The reliability of arvif->iscreated across all error paths is ensured by the preceding patch.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPLV1.0V2.0SILICONZ-1.115823.3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In ath12k_mac_op_change_sta_links(), check arvif->is_created before calling ath12k_mac_alloc_assign_link_sta() and prevent an uncreated link from being added to links_map, avoiding NULL dereferences of arvif->ar.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74366?
The severity of CVE-2026-74366 is rated at 38.
How do I fix CVE-2026-74366?
To fix CVE-2026-74366, update your Linux kernel to the latest available version that addresses this vulnerability.
What type of vulnerability is CVE-2026-74366?
CVE-2026-74366 is classified as a Null Pointer Dereference vulnerability in the Linux kernel.
Which software is affected by CVE-2026-74366?
CVE-2026-74366 affects the Linux kernel.
What is the impact of CVE-2026-74366 on systems?
CVE-2026-74366 can cause a NULL dereference, potentially leading to system crashes or instability.