Executive brief
The ath12k WiFi driver in the Linux kernel contains a use-after-free vulnerability in its access point vdev initialization error path. When AP device setup fails after peer creation, dangling pointers remain in internal data structures that are subsequently freed, causing memory corruption or system crashes during later WiFi operations.
Technical details
This is a use-after-free vulnerability in the ath12k WiFi driver's dp_link_peer handling. In ath12k_mac_vdev_create(), when creating an AP vdev, the peer creation publishes references in three locations: the dp_hw RCU table, the dp_peer link_peers array, and a per-address rhashtable. If initialization fails after peer_create, the error path jumps to err_peer_del which open-codes a WMI peer delete without first calling ath12k_dp_link_peer_unassign(). This leaves dangling pointers in the published data structures that are subsequently freed when the unmap event arrives, causing use-after-free on any subsequent peer lookups. The fix replaces the open-coded sequence with ath12k_peer_delete(), which properly unassigns the published references before the WMI deletion, matching the normal teardown sequence. No user interaction is required; exploitation occurs during normal driver error handling paths.
Affected products
- Linux Linux Kernel 5.x through 7.x (ath12k driver)
Timeline
- 2026-09-17: disclosed: CVE published via NVD
- 2026-07-14: patched: Fix committed upstream as f066e1a93703c5be0fd905109d00587541711c97
- 2026-09-14: patched: Fix included in stable kernel releases