CVE-2026-93094: wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback
ath12kmacvdevcreate() for an AP vdev creates the bss self-peer via ath12kpeercreate(), which finishes by calling ath12kdplinkpeerassign() to publish the dplinkpeer in the dphw->dppeers[peeridindex] RCU table, in the dppeer's linkpeers[] array, and in the per-addr rhashtable.
If a step after ath12kpeercreate() fails the function jumps to errpeerdel, which open-codes a WMI peerdelete and waits for the unmap / deleteresp events. The waitforpeerdeletedone() path relies on ath12kdplinkpeerunmapevent() freeing the dplinkpeer when the unmap arrives, but errpeerdel never calls ath12kdplinkpeerunassign() first. The published references in the dphw RCU table, dppeer->linkpeers[] and the rhashtable are left pointing at the dplinkpeer that unmapevent then frees, producing dangling pointers and use-after-free on subsequent lookups.
Replace the open-coded sequence with a call to ath12kpeerdelete(), which already does ath12kdplinkpeerunassign() before sending the WMI command. This drops the published references before the dplinkpeer is freed, in the same order as the normal teardown path in ath12kmacremovelinkinterface().
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPLV1.0V2.0SILICONZUPSTREAM-3
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ath12k Wi-Fi driver are exposed when creating an AP virtual interface reaches a failure path after the BSS self-peer has been created. The issue is specific to AP vdev rollback handling.
What condition triggers the use-after-free?
A later step in ath12k_mac_vdev_create() must fail after ath12k_peer_create() has published the BSS self-peer references. The rollback path then deletes the peer without first unassigning its published dp_link_peer references, leaving stale pointers after the unmap event frees the object.
How can this be remediated?
Apply a kernel version containing the referenced fixes. The correction replaces the open-coded rollback deletion sequence with ath12k_peer_delete(), which unassigns dp_link_peer references before issuing the peer-delete command.