Description
In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()

ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the
free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is
wrong: dp_peer->peer_id for an MLO peer always carries the
ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with
index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS
(256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The
intended bitmap entry also never gets cleared, so subsequent
ath12k_peer_ml_alloc() calls eventually run out of IDs.

The ID without the VALID bit is what ath12k_peer_ml_alloc() returned and
is stored in ahsta->ml_peer_id. Use that instead.

While there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so
the bitmap and ahsta->ml_peer_id stay in sync.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Published: 2026-08-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The ath12k Wi‑Fi driver for Qualcomm Atheros 12k chips performed an out‑of‑bounds clear_bit during peer cleanup. The function used dp_peer->peer_id, which contains a validation flag, causing the clear_bit index to exceed the 256‑bit free_ml_peer_id_map bitmap. This write corrupts adjacent kernel memory and never clears the intended bitmap entry, eventually exhausting peer IDs. The flaw is a kernel memory corruption that can lead to driver crashes or denial of service, but does not provide a documented remote code execution path.

Affected Systems

All Linux kernels that ship the ath12k driver before the patch are affected. The driver is used on Qualcomm Atheros 12k series wireless hardware such as the WCN7850 PCI WLAN module. Any distribution, release, or mainline kernel containing the older ath12k_mac_dp_peer_cleanup routine is vulnerable.

Risk and Exploitability

The CVSS base score is 8.8, categorising it as high severity. The EPSS is reported around <1%, indicating exploitation attempts are rare at present. The vulnerability is not listed in CISA KEV catalog. Based on the description, it is inferred that a local attacker who can generate wireless traffic that triggers the cleanup routine could cause a crash, and a remote attacker with access to the wireless interface might also be able to trigger the flaw. No public exploit is documented, so the primary risk is local and results in denial of service or kernel instability.

Generated by OpenCVE AI on August 21, 2026 at 19:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to a version that includes the ath12k driver patch fixing the out‑of‑bounds clear_bit issue; recent stable releases contain the change.
  • If a kernel upgrade is not immediately feasible, disable multi‑link peer allocation or configure the ath12k driver to avoid using the vulnerable cleanup path, which prevents the memory corruption until a patch can be applied.
  • Limit or disable Wi‑Fi interfaces that are not required, thereby reducing the opportunity for an attacker to trigger the cleanup sequence until remediation is applied.

Generated by OpenCVE AI on August 21, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 17 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Mon, 17 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 15 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is wrong: dp_peer->peer_id for an MLO peer always carries the ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS (256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The intended bitmap entry also never gets cleared, so subsequent ath12k_peer_ml_alloc() calls eventually run out of IDs. The ID without the VALID bit is what ath12k_peer_ml_alloc() returned and is stored in ahsta->ml_peer_id. Use that instead. While there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so the bitmap and ahsta->ml_peer_id stay in sync. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Title wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:48:37.563Z

Reserved: 2026-08-15T05:44:03.916Z

Link: CVE-2026-74554

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:18:00.830

Modified: 2026-08-17T06:19:53.470

Link: CVE-2026-74554

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74554 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T19:30:05Z

Weaknesses