CVE-2026-74554: wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix out-of-bounds clearbit in ath12kmacdppeercleanup()
ath12kmacdppeercleanup() clears the ML peer ID slot on the freemlpeeridmap bitmap by indexing it with dppeer->peerid. That is wrong: dppeer->peerid for an MLO peer always carries the ATH12KPEERMLIDVALID bit (BIT(13)), so clearbit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12KMAXMLOPEERS (256) bits and corrupts memory adjacent to ah->freemlpeeridmap. The intended bitmap entry also never gets cleared, so subsequent ath12kpeermlalloc() calls eventually run out of IDs.
The ID without the VALID bit is what ath12kpeermlalloc() returned and is stored in ahsta->mlpeerid. Use that instead.
While there, also reset ahsta->mlpeerid to ATH12KMLOPEERIDINVALID so the bitmap and ahsta->mlpeerid stay in sync.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPLV1.0V2.0SILICONZ-1.115823.3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74554?
CVE-2026-74554 has a risk rating of 44, indicating a moderate severity.
How do I fix CVE-2026-74554?
To fix CVE-2026-74554, update your Linux kernel to the latest version that includes the patch.
What systems are affected by CVE-2026-74554?
CVE-2026-74554 affects systems running the Linux kernel with the ath12k WiFi driver.
What is the impact of CVE-2026-74554?
The impact of CVE-2026-74554 is an out-of-bounds write that could potentially lead to data corruption or denial of service.
When was CVE-2026-74554 published?
CVE-2026-74554 was published on August 15, 2026.