Executive brief
The Linux kernel's WiFi driver (ath12k) contains a bug that can cause the system to crash when handling station link changes on Qualcomm wireless chipsets. Under specific conditions where a wireless link fails to initialize, subsequent operations like disconnecting from a network or installing encryption keys can trigger a crash, potentially disrupting wireless connectivity.
Technical details
This is a NULL pointer dereference vulnerability in the ath12k WiFi driver's change_sta_links operation. The root cause occurs when _ieee80211_set_active_links() fails to initialize a mac80211-level channel validation (due to combinations check, DFS, or no available radio), causing arvif->ar to remain NULL. However, the failed link is still added to links_map via ath12k_mac_op_change_sta_links(). Subsequent operations that iterate links_map and dereference arvif->ar without NULL checks crash, as observed in ath12k_mac_ml_station_remove() on disconnect and ath12k_mac_op_set_key() during PTK key installation. The fix adds a check for arvif->is_created before calling ath12k_mac_alloc_assign_link_sta() to prevent broken links from entering links_map. This is a local kernel vulnerability requiring user interaction (network operations) and affects systems with Qualcomm wireless adapters like WCN7850.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-08-15: disclosed