PT-2026-46011 · Linux · Linux

Published

2026-06-03

·

Updated

2026-06-03

·

CVE-2026-46248

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: clear stale link mapping of ahvif->links map
When an arvif is initialized in non-AP STA mode but MLO connection preparation fails before the arvif is created (arvif->is created remains false), the error path attempts to delete all links. However, link deletion only executes when arvif->is created is true. As a result, ahvif retains a stale entry of arvif that is initialized but not created.
When a new arvif is initialized with the same link id, this stale mapping triggers the following WARN ON.
WARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12k mac op change vif links+0x140/0x180 [ath12k], CPU#3: wpa supplicant/275
Call trace: ath12k mac op change vif links+0x140/0x180 [ath12k] (P) drv change vif links+0xbc/0x1a4 [mac80211] ieee80211 vif update links+0x54c/0x6a0 [mac80211] ieee80211 vif set links+0x40/0x70 [mac80211] ieee80211 prep connection+0x84/0x450 [mac80211] ieee80211 mgd auth+0x200/0x480 [mac80211] ieee80211 auth+0x14/0x20 [mac80211] cfg80211 mlme auth+0x90/0xf0 [cfg80211] nl80211 authenticate+0x32c/0x380 [cfg80211] genl family rcv msg doit+0xc8/0x134
Fix this issue by unassigning the link vif and clearing ahvif->links map if arvif is only initialized but not created.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL SILICONZ-1

Related Identifiers

CVE-2026-46248

Affected Products

Linux