CVE-2026-74366

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix NULL deref in change_sta_links for unready link

_ieee80211_set_active_links() calls _ieee80211_link_use_channel() for

each newly-added link and WARN_ON_ONCE()s if it fails. The call uses

assign_on_failure=true, which allows mac80211 to continue despite

driver failures, but when a mac80211-level channel validation fails

(e.g., combinations check, DFS, or no available radio),

drv_assign_vif_chanctx() is never reached. Since ath12k_mac_vdev_create()

is only called from that path, arvif->is_created remains false and

arvif->ar remains NULL for the failed link.

The subsequent drv_change_sta_links() call reaches

ath12k_mac_op_change_sta_links(), which allocates an arsta and sets

ahsta->links_map |= BIT(link_id) for the broken link before checking

whether the link is ready. When the vdev was never created, only

station_add() is skipped, but the link remains in links_map.

Any subsequent operation iterating

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References