CVE-2026-74554: wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix out-of-bounds clearbit in ath12kmacdppeercleanup()
ath12kmacdppeercleanup() clears the ML peer ID slot on the freemlpeeridmap bitmap by indexing it with dppeer->peerid. That is wrong: dppeer->peerid for an MLO peer always carries the ATH12KPEERMLIDVALID bit (BIT(13)), so clearbit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12KMAXMLOPEERS (256) bits and corrupts memory adjacent to ah->freemlpeeridmap. The intended bitmap entry also never gets cleared, so subsequent ath12kpeermlalloc() calls eventually run out of IDs.
The ID without the VALID bit is what ath12kpeermlalloc() returned and is stored in ahsta->mlpeerid. Use that instead.
While there, also reset ahsta->mlpeerid to ATH12KMLOPEERIDINVALID so the bitmap and ahsta->mlpeerid stay in sync.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPLV1.0V2.0SILICONZ-1.115823.3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update ath12k_mac_dp_peer_cleanup() to clear the correct free_ml_peer_id_map bitmap entry by using the peer ML ID value that ath12k_peer_ml_alloc() returned (the ID without the ATH12K_PEER_ML_ID_VALID BIT(13) instead of masking/using the VALID-bit value). Also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so the ML peer ID slot stays consistent with the bitmap.
Linux kernel (wifi: ath12k) ath12k_mac_dp_peer_cleanup() bitmap clearing logic = Use the ID returned by ath12k_peer_ml_alloc() without the ATH12K_PEER_ML_ID_VALID bit; additionally set ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74554?
CVE-2026-74554 has a risk rating of 44, indicating a moderate severity.
How do I fix CVE-2026-74554?
To fix CVE-2026-74554, update your Linux kernel to the latest version that includes the patch.
What systems are affected by CVE-2026-74554?
CVE-2026-74554 affects systems running the Linux kernel with the ath12k WiFi driver.
What is the impact of CVE-2026-74554?
The impact of CVE-2026-74554 is an out-of-bounds write that could potentially lead to data corruption or denial of service.
When was CVE-2026-74554 published?
CVE-2026-74554 was published on August 15, 2026.