UBUNTU-CVE-2026-74366: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks() calls ieee80211linkusechannel() for each newly-added link and WARNONONCE()s if it fails. The call uses assignonfailure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drvassignvifchanctx() is never reached. Since ath12kmacvdevcreate() is only called from that path, arvif->iscreated remains false and arvif->ar remains NULL for the failed link. The subsequent drvchangestalinks() call reaches ath12kmacopchangestalinks(), which allocates an arsta and sets ahsta->linksmap |= BIT(linkid) for the broken link before checking whether the link is ready. When the vdev was never created, only stationadd() is skipped, but the link remains in linksmap. Any subsequent operation iterating linksmap and dereferencing arvif->ar without a NULL check will crash. Two observed examples are NULL deref in ath12kmacmlstationremove() on disconnect and in ath12kmacopsetkey() when wpasupplicant installs PTK keys. BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacstationpostremove+0x40/0xe8 [ath12k] Call trace: ath12kmacstationpostremove+0x40/0xe8 [ath12k] ath12kmacopstastate+0xb60/0x1720 [ath12k] drvstastate+0x100/0xbd8 [mac80211] stainfodestroypart2+0x148/0x178 [mac80211] ieee80211setdisassoc+0x500/0x678 [mac80211] BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] Call trace: ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] drvsetkey+0x70/0x100 [mac80211] ieee80211keyenablehwaccel+0x78/0x260 [mac80211] ieee80211addkey+0x16c/0x2ac [mac80211] nl80211newkey+0x138/0x280 [cfg80211] Fix this by checking arvif->iscreated before calling ath12kmacallocassignlinksta(). This prevents the broken link from entering linksmap, so all subsequent operations iterating the bitmap are protected. The reliability of arvif->iscreated across all error paths is ensured by the preceding patch. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPLV1.0V2.0SILICONZ-1.115823.3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
What conditions are needed to trigger the crash?
A newly added Wi-Fi link must fail mac80211-level channel validation, such as a combinations check failure, DFS condition, or lack of an available radio. mac80211 then continues despite the failed driver channel assignment, leaving the ath12k link unready and without a created vdev.
When might the system crash after the failed link setup?
The crash can occur during a later operation that iterates the station link map and dereferences the uninitialized link state. Observed cases include disconnect handling in ath12k_mac_ml_station_remove() and key configuration in ath12k_mac_op_set_key(), such as when wpa_supplicant performs a key-related operation.
Which Ubuntu kernel packages are identified as affected?
The listed affected packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.