DEBIAN-CVE-2026-74366

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-74366
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-74366.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-74366
Upstream
Published
2026-08-15T06:22:38.287Z
Modified
2026-08-17T08:47:41.158874587Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks() calls ieee80211linkusechannel() for each newly-added link and WARNONONCE()s if it fails. The call uses assignonfailure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drvassignvifchanctx() is never reached. Since ath12kmacvdevcreate() is only called from that path, arvif->iscreated remains false and arvif->ar remains NULL for the failed link. The subsequent drvchangestalinks() call reaches ath12kmacopchangestalinks(), which allocates an arsta and sets ahsta->linksmap |= BIT(linkid) for the broken link before checking whether the link is ready. When the vdev was never created, only stationadd() is skipped, but the link remains in linksmap. Any subsequent operation iterating linksmap and dereferencing arvif->ar without a NULL check will crash. Two observed examples are NULL deref in ath12kmacmlstationremove() on disconnect and in ath12kmacopsetkey() when wpasupplicant installs PTK keys. BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacstationpostremove+0x40/0xe8 [ath12k] Call trace: ath12kmacstationpostremove+0x40/0xe8 [ath12k] ath12kmacopstastate+0xb60/0x1720 [ath12k] drvsta_state+0x100/0xbd8 [mac80211] __stainfodestroypart2+0x148/0x178 [mac80211] ieee80211setdisassoc+0x500/0x678 [mac80211] BUG: Unable to handle kernel NULL pointer dereference at 0x00000000 pc : ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] Call trace: ath12kmacopsetkey+0x1f8/0x2c0 [ath12k] drvsetkey+0x70/0x100 [mac80211] ieee80211keyenablehwaccel+0x78/0x260 [mac80211] ieee80211addkey+0x16c/0x2ac [mac80211] nl80211newkey+0x138/0x280 [cfg80211] Fix this by checking arvif->iscreated before calling ath12kmacallocassignlinksta(). This prevents the broken link from entering linksmap, so all subsequent operations iterating the bitmap are protected. The reliability of arvif->iscreated across all error paths is ensured by the preceding patch. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPLV1.0V2.0SILICONZ-1.115823.3

References

Affected packages

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.1.5-1

Affected versions

6.*
6.12.38-1
6.12.41-1
6.12.43-1~bpo12+1
6.12.43-1
6.12.48-1
6.12.57-1~bpo12+1
6.12.57-1
6.12.63-1~bpo12+1
6.12.63-1
6.12.69-1~bpo12+1
6.12.69-1
6.12.73-1~bpo12+1
6.12.73-1
6.12.74-1
6.12.74-2~bpo12+1
6.12.74-2
6.12.85-1~bpo12+1
6.12.85-1
6.12.86-1~bpo12+1
6.12.86-1
6.12.88-1~bpo12+1
6.12.88-1
6.12.90-1~bpo12+1
6.12.90-1
6.12.90-2~bpo12+1
6.12.90-2
6.12.94-1~bpo12+1
6.12.94-1
6.12.95-1~bpo12+1
6.12.95-1
6.12.96-1
6.12.100-1
6.12.101-1
6.13~rc6-1~exp1
6.13~rc7-1~exp1
6.13.2-1~exp1
6.13.3-1~exp1
6.13.4-1~exp1
6.13.5-1~exp1
6.13.6-1~exp1
6.13.7-1~exp1
6.13.8-1~exp1
6.13.9-1~exp1
6.13.10-1~exp1
6.13.11-1~exp1
6.14.3-1~exp1
6.14.5-1~exp1
6.14.6-1~exp1
6.15~rc7-1~exp1
6.15-1~exp1
6.15.1-1~exp1
6.15.2-1~exp1
6.15.3-1~exp1
6.15.4-1~exp1
6.15.5-1~exp1
6.15.6-1~exp1
6.16~rc7-1~exp1
6.16-1~exp1
6.16.1-1~exp1
6.16.3-1~bpo13+1
6.16.3-1
6.16.5-1
6.16.6-1
6.16.7-1
6.16.8-1
6.16.9-1
6.16.10-1
6.16.11-1
6.16.12-1~bpo13+1
6.16.12-1
6.16.12-2
6.17.2-1~exp1
6.17.5-1~exp1
6.17.6-1
6.17.7-1
6.17.7-2
6.17.8-1~bpo13+1
6.17.8-1
6.17.9-1
6.17.10-1
6.17.11-1
6.17.12-1
6.17.13-1~bpo13+1
6.17.13-1
6.18~rc4-1~exp1
6.18~rc4-1~exp2
6.18~rc5-1~exp1
6.18~rc6-1~exp1
6.18~rc7-1~exp1
6.18.1-1~exp1
6.18.2-1~exp1
6.18.3-1
6.18.5-1~bpo13+1
6.18.5-1
6.18.8-1
6.18.9-1~bpo13+1
6.18.9-1
6.18.10-1
6.18.12-1~bpo13+1
6.18.12-1
6.18.13-1
6.18.14-1
6.18.15-1~bpo13+1
6.18.15-1
6.19~rc4-1~exp1
6.19~rc5-1~exp1
6.19~rc6-1~exp1
6.19~rc7-1~exp1
6.19~rc8-1~exp1
6.19-1~exp1
6.19.2-1~exp1
6.19.3-1~exp1
6.19.4-1~exp1
6.19.5-1~exp1
6.19.6-1
6.19.6-2~bpo13+1
6.19.6-2
6.19.8-1~bpo13+1
6.19.8-1
6.19.10-1~bpo13+1
6.19.10-1
6.19.11-1~bpo13+1
6.19.11-1
6.19.12-1
6.19.13-1~bpo13+1
6.19.13-1
6.19.14-1~bpo13+1
6.19.14-1
7.*
7.0-1~exp1
7.0.1-1~exp1
7.0.3-1
7.0.4-1~bpo13+1
7.0.4-1
7.0.7-1~bpo13+1
7.0.7-1
7.0.9-1~bpo13+1
7.0.9-1
7.0.10-1~bpo13+1
7.0.10-1
7.0.12-1
7.0.12-2~bpo13+1
7.0.12-2
7.0.13-1~bpo13+1
7.0.13-1
7.0.14-1
7.1~rc2-1~exp1
7.1~rc3-1~exp1
7.1~rc4-1~exp1
7.1~rc4-1~exp2
7.1~rc5-1~exp1
7.1~rc7-1~exp1
7.1.1-1~exp1
7.1.2-1~exp1
7.1.3-1~bpo13+1
7.1.3-1
7.1.3-1+sunvdc
7.1.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-74366.json"