CVE-2026-46248

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: clear stale link mapping of ahvif->links_map

When an arvif is initialized in non-AP STA mode but MLO connection preparation fails before the arvif is created (arvif->iscreated remains false), the error path attempts to delete all links. However, link deletion only executes when arvif->iscreated is true. As a result, ahvif retains a stale entry of arvif that is initialized but not created.

When a new arvif is initialized with the same link id, this stale mapping triggers the following WARN_ON.

WARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12kmacopchangeviflinks+0x140/0x180 [ath12k], CPU#3: wpasupplicant/275

Call trace: ath12kmacopchangeviflinks+0x140/0x180 [ath12k] (P) drvchangeviflinks+0xbc/0x1a4 [mac80211] ieee80211vifupdatelinks+0x54c/0x6a0 [mac80211] ieee80211vifsetlinks+0x40/0x70 [mac80211] ieee80211prepconnection+0x84/0x450 [mac80211] ieee80211mgdauth+0x200/0x480 [mac80211] ieee80211auth+0x14/0x20 [mac80211] cfg80211mlmeauth+0x90/0xf0 [cfg80211] nl80211authenticate+0x32c/0x380 [cfg80211] genlfamilyrcvmsgdoit+0xc8/0x134

Fix this issue by unassigning the link vif and clearing ahvif->links_map if arvif is only initialized but not created.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1