CVE-2026-74366 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix NULL deref in change_sta_links for unready link
_ieee80211_set_active_links() calls _ieee80211_link_use_channel() for each newly-added link and WARN_ON_ONCE()s if it fails. The call uses assign_on_failure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drv_assign_vif_chanctx() is never reached. Since ath12k_mac_vdev_create() is only called from that path, arvif->is_created remains false and arvif->ar remains NULL for the failed link.
The subsequent drv_change_sta_links() call reaches ath12k_mac_op_change_sta_links(), which allocates an arsta and sets ahsta->links_map |= BIT(link_id) for the broken link before checking whether the link is ready. When the vdev was never created, only station_add() is skipped, but the link remains in links_map.
Any subsequent operation iterating links_map and dereferencing arvif->ar without a NULL check will crash. Two observed examples are NULL deref in ath12k_mac_ml_station_remove() on disconnect and in ath12k_mac_op_set_key() when wpa_supplicant installs PTK keys.
BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12k_mac_station_post_remove+0x40/0xe8 [ath12k]
Call trace: ath12k_mac_station_post_remove+0x40/0xe8 [ath12k]
ath12k_mac_op_sta_state+0xb60/0x1720 [ath12k]
drv_sta_state+0x100/0xbd8 [mac80211]
__sta_info_destroy_part2+0x148/0x178 [mac80211]
ieee80211_set_disassoc+0x500/0x678 [mac80211]
BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12k_mac_op_set_key+0x1f8/0x2c0 [ath12k]
Call trace: ath12k_mac_op_set_key+0x1f8/0x2c0 [ath12k]
drv_set_key+0x70/0x100 [mac80211]
ieee80211_key_enable_hw_accel+0x78/0x260 [mac80211]
ieee80211_add_key+0x16c/0x2ac [mac80211]
nl80211_new_key+0x138/0x280 [cfg80211]
Fix this by checking arvif->is_created before calling ath12k_mac_alloc_assign_link_sta(). This prevents the broken link from entering links_map, so all subsequent operations iterating the bitmap are protected. The reliability of arvif->is_created across all error paths is ensured by the preceding patch.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described affects the ath12k wireless driver within the Linux kernel and represents a critical NULL pointer dereference issue that can lead to system crashes. This flaw occurs during the management of station links in wireless communication scenarios, specifically when handling failed channel assignment operations. The root cause stems from improper state validation within the mac80211 subsystem where certain error conditions fail to properly initialize driver structures, leaving virtual interface references in an inconsistent state.
The technical flaw manifests through a sequence of function calls that begin with _ieee80211_set_active_links() invoking _ieee80211_link_use_channel() with assign_on_failure=true parameter. This configuration allows the mac80211 layer to continue processing even when driver-level channel assignment fails, but does not properly handle cases where no available radio resources exist or where DFS (Dynamic Frequency Selection) constraints prevent valid channel assignment. When such failures occur, the driver's ath12k_mac_vdev_create() function is never invoked, resulting in arvif->is_created remaining false and arvif->ar being left as NULL for the problematic link.
Subsequently, during the drv_change_sta_links() operation, the system allocates an arsta structure and sets ahsta->links_map |= BIT(link_id) for the broken link without verifying whether the underlying virtual device was actually created. This creates a scenario where the link appears to be active in the links_map bitmap but lacks proper initialization of its associated resources, particularly the arvif->ar pointer that is essential for subsequent operations. The vulnerability becomes apparent when later operations iterate through links_map and attempt to dereference arvif->ar without checking for NULL values, leading to kernel crashes.
The operational impact of this vulnerability is severe as it can cause complete system instability during normal wireless operations, particularly during station disconnection events or key installation processes. Two specific crash scenarios have been identified: the first occurs in ath12k_mac_ml_station_remove() during disconnect operations, and the second manifests in ath12k_mac_op_set_key() when wpa_supplicant attempts to install PTK (Pairwise Transient Key) keys. Both scenarios involve direct NULL pointer dereferences that result in kernel oops messages and system crashes, as evidenced by the call traces showing failures in ath12k_mac_station_post_remove() and ath12k_mac_op_set_key() functions.
This vulnerability aligns with CWE-476 which describes NULL Pointer Dereference and relates to ATT&CK technique T1547.001 for system service manipulation through kernel vulnerabilities. The fix implements a defensive programming approach by adding a check for arvif->is_created before calling ath12k_mac_alloc_assign_link_sta(), preventing broken links from entering the links_map bitmap entirely. This mitigation ensures that all subsequent operations iterating through the links_map bitmap are protected since they will only process properly initialized virtual interface references. The reliability of the arvif->is_created flag across all error paths has been strengthened by a preceding patch, making this fix comprehensive and robust against similar issues in related code paths.
The solution addresses fundamental race conditions and state management issues that can occur in wireless driver subsystems when handling complex channel assignment scenarios involving multiple radio interfaces and regulatory domain constraints. This represents a classic example of how incomplete error handling in kernel drivers can lead to exploitable conditions, particularly in security-sensitive environments where wireless connectivity is critical for system operation. The fix demonstrates proper defensive programming practices by ensuring that all resource access paths are validated before proceeding with potentially dangerous operations.