CVE-2026-74366

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix NULL deref in changestalinks for unready link

ieee80211setactivelinks() calls ieee80211linkusechannel() for each newly-added link and WARNONONCE()s if it fails. The call uses assignonfailure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drvassignvifchanctx() is never reached. Since ath12kmacvdevcreate() is only called from that path, arvif->is_created remains false and arvif->ar remains NULL for the failed link.

The subsequent drvchangestalinks() call reaches ath12kmacopchangestalinks(), which allocates an arsta and sets ahsta->linksmap |= BIT(linkid) for the broken link before checking whether the link is ready. When the vdev was never created, only stationadd() is skipped, but the link remains in linksmap.

Any subsequent operation iterating linksmap and dereferencing arvif->ar without a NULL check will crash. Two observed examples are NULL deref in ath12kmacmlstationremove() on disconnect and in ath12kmacopsetkey() when wpasupplicant installs PTK keys.

BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacstationpostremove+0x40/0xe8 [ath12k] Call trace: ath12kmacstationpostremove+0x40/0xe8 [ath12k] ath12kmacopstastate+0xb60/0x1720 [ath12k] drvstastate+0x100/0xbd8 [mac80211] _stainfodestroypart2+0x148/0x178 [mac80211] ieee80211setdisassoc+0x500/0x678 [mac80211]

BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] Call trace: ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] drvsetkey+0x70/0x100 [mac80211] ieee80211keyenablehwaccel+0x78/0x260 [mac80211] ieee80211addkey+0x16c/0x2ac [mac80211] nl80211newkey+0x138/0x280 [cfg80211]

Fix this by checking arvif->iscreated before calling ath12kmacallocassignlinksta(). This prevents the broken link from entering linksmap, so all subsequent operations iterating the bitmap are protected. The reliability of arvif->iscreated across all error paths is ensured by the preceding patch.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPLV1.0V2.0_SILICONZ-1.115823.3