CVE-2026-74554

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix out-of-bounds clearbit in ath12kmacdppeer_cleanup()

ath12kmacdppeercleanup() clears the ML peer ID slot on the freemlpeeridmap bitmap by indexing it with dppeer->peerid. That is wrong: dppeer->peerid for an MLO peer always carries the ATH12KPEERMLIDVALID bit (BIT(13)), so clearbit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12KMAXMLOPEERS (256) bits and corrupts memory adjacent to ah->freemlpeeridmap. The intended bitmap entry also never gets cleared, so subsequent ath12kpeerml_alloc() calls eventually run out of IDs.

The ID without the VALID bit is what ath12kpeermlalloc() returned and is stored in ahsta->mlpeer_id. Use that instead.

While there, also reset ahsta->mlpeerid to ATH12KMLOPEERIDINVALID so the bitmap and ahsta->mlpeerid stay in sync.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPLV1.0V2.0_SILICONZ-1.115823.3