PT-2026-46011 · Linux · Linux
Published
2026-06-03
·
Updated
2026-06-03
·
CVE-2026-46248
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: clear stale link mapping of ahvif->links map
When an arvif is initialized in non-AP STA mode but MLO connection
preparation fails before the arvif is created
(arvif->is created remains false), the error path attempts to delete all
links. However, link deletion only executes when arvif->is created is true.
As a result, ahvif retains a stale entry of arvif that is initialized but
not created.
When a new arvif is initialized with the same link id, this stale mapping
triggers the following WARN ON.
WARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12k mac op change vif links+0x140/0x180 [ath12k], CPU#3: wpa supplicant/275
Call trace:
ath12k mac op change vif links+0x140/0x180 [ath12k] (P)
drv change vif links+0xbc/0x1a4 [mac80211]
ieee80211 vif update links+0x54c/0x6a0 [mac80211]
ieee80211 vif set links+0x40/0x70 [mac80211]
ieee80211 prep connection+0x84/0x450 [mac80211]
ieee80211 mgd auth+0x200/0x480 [mac80211]
ieee80211 auth+0x14/0x20 [mac80211]
cfg80211 mlme auth+0x90/0xf0 [cfg80211]
nl80211 authenticate+0x32c/0x380 [cfg80211]
genl family rcv msg doit+0xc8/0x134
Fix this issue by unassigning the link vif and clearing ahvif->links map
if arvif is only initialized but not created.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL SILICONZ-1
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux