CVE-2026-93094

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback

ath12k_mac_vdev_create() for an AP vdev creates the bss self-peer via

ath12k_peer_create(), which finishes by calling

ath12k_dp_link_peer_assign() to publish the dp_link_peer in the

dp_hw->dp_peers[peerid_index] RCU table, in the dp_peer's

link_peers[] array, and in the per-addr rhashtable.

If a step after ath12k_peer_create() fails the function jumps to

err_peer_del, which open-codes a WMI peer_delete and waits for the

unmap / delete_resp events. The wait_for_peer_delete_done() path

relies on ath12k_dp_link_peer_unmap_event() freeing the dp_link_peer

when the unmap arrives, but err_peer_del never calls

ath12k_dp_link_peer_unassign() first. The published references in

the dp_hw RCU table, dp_peer->link_peers[] and the rhashtable are

left pointing at the dp_link_peer that unmap_event then frees,

producing dangling pointers and use-after-free on su

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References