vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-46248

wifi: ath12k: clear stale link mapping of ahvif->links_map

MEDIUM
5.5
CVSS Score
Published: June 3, 2026 at 03:49 PM UTC
Updated: July 22, 2026 at 08:24 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: clear stale link mapping of ahvif->links_map When an arvif is initialized in non-AP STA mode but MLO connection preparation fails before the arvif is created (arvif->is_created remains false), the error path attempts to delete all links. However, link deletion only executes when arvif->is_created is true. As a result, ahvif retains a stale entry of arvif that is initialized but not created. When a new arvif is initialized with the same link id, this stale mapping triggers the following WARN_ON. WARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k], CPU#3: wpa_supplicant/275 Call trace: ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k] (P) drv_change_vif_links+0xbc/0x1a4 [mac80211] ieee80211_vif_update_links+0x54c/0x6a0 [mac80211] ieee80211_vif_set_links+0x40/0x70 [mac80211] ieee80211_prep_connection+0x84/0x450 [mac80211] ieee80211_mgd_auth+0x200/0x480 [mac80211] ieee80211_auth+0x14/0x20 [mac80211] cfg80211_mlme_auth+0x90/0xf0 [cfg80211] nl80211_authenticate+0x32c/0x380 [cfg80211] genl_family_rcv_msg_doit+0xc8/0x134 Fix this issue by unassigning the link vif and clearing ahvif->links_map if arvif is only initialized but not created. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
6.15 ≤ v < 6.18.146.15 ≤ v < 6.19.46.15 ≤ v < 7.06.19 ≤ v < 6.19.46.1581e4be30544ee7e8da80e9aae7acd69d3be6d05a
Vendor states this is fixed in 2c1ba9c2adf0fda96eaaebd8799268a7506a8fc9 (fixed)
Vendor states this is fixed in acd8319e834be6790e449701cb6df0f636801977 (fixed)
Vendor states this is fixed in da289440f04c93048d82d293b180f1cacdfee2d9 (fixed)
Vendor states this is fixed in 6.15 (unaffected)
Vendor states this is fixed in 6.18.14 (unaffected)
Vendor states this is fixed in 6.19.4 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

References (3)

Patch
Source: cverecord
https://git.kernel.org/stable/c/da289440f04c93048d82d293b180f1cacdfee2d9
Patch
Source: cverecord
https://git.kernel.org/stable/c/acd8319e834be6790e449701cb6df0f636801977
Patch
Source: cverecord
https://git.kernel.org/stable/c/2c1ba9c2adf0fda96eaaebd8799268a7506a8fc9

CVSS

5.5MEDIUM[email protected]
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card