UBUNTU-CVE-2026-93094: Use After Free

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback ath12kmacvdevcreate() for an AP vdev creates the bss self-peer via ath12kpeercreate(), which finishes by calling ath12kdplinkpeerassign() to publish the dplinkpeer in the dphw->dppeers[peeridindex] RCU table, in the dppeer's linkpeers[] array, and in the per-addr rhashtable. If a step after ath12kpeercreate() fails the function jumps to errpeerdel, which open-codes a WMI peerdelete and waits for the unmap / deleteresp events. The waitforpeerdeletedone() path relies on ath12kdplinkpeerunmapevent() freeing the dplinkpeer when the unmap arrives, but errpeerdel never calls ath12kdplinkpeerunassign() first. The published references in the dphw RCU table, dppeer->linkpeers[] and the rhashtable are left pointing at the dplinkpeer that unmapevent then frees, producing dangling pointers and use-after-free on subsequent lookups. Replace the open-coded sequence with a call to ath12kpeerdelete(), which already does ath12kdplinkpeerunassign() before sending the WMI command. This drops the published references before the dplinkpeer is freed, in the same order as the normal teardown path in ath12kmacremovelinkinterface(). Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPLV1.0V2.0SILICONZUPSTREAM-3