Executive brief
The Linux kernel's ath12k Wi-Fi driver has error-handling bugs in virtual device creation that leave internal state inconsistent when operations fail. This can cause the driver to incorrectly believe a wireless interface is ready when it isn't, leading to unpredictable behavior, potential crashes, or denial of service during device creation or removal operations.
Technical details
The vulnerability exists in the ath12k_mac_vdev_create() function in drivers/net/wireless/ath/ath12k/mac.c. Three error path issues leave the arvif (virtual interface) structure in an inconsistent state: (1) when WMI vdev creation fails, the function returns directly without clearing arvif->ar, causing subsequent code to incorrectly detect a ready vdev; (2) when peer deletion fails, error paths skip DP peer cleanup and vdev rollback; (3) when peer deletion timeout occurs, DP peer cleanup is skipped. The fix consolidates cleanup logic by routing failed operations through proper error labels (err_dp_peer_del and err) to ensure arvif->is_created and arvif->ar are consistently cleared. The patch affects kernel versions with the MLO (multi-link operation) changes introduced in commit 477cabfdb776.
Affected products
- Linux Linux Kernel 6.0+, specifically versions with ath12k MLO support (commit 477cabfdb776 and later)
Timeline
- 2026-08-15: disclosed
- 2026-06-01: patched: Upstream patch committed by Jeff Johnson