CVE-2026-74366

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the ath12k wifi driver. When ieee80211 set active links() calls ieee80211 link use channel() and a channel validation fails, the function drv assign vif chanctx() is not reached. Consequently, ath12k mac vdev create() is not called, leaving the variable arvif->is created as false and arvif->ar as NULL for the failed link.

Subsequent calls to drv change sta links() lead to ath12k mac op change sta links(), which adds the broken link to the ahsta->links map without verifying if the link is ready. Any later operation that iterates through links map and dereferences arvif->ar without a NULL check will cause a system crash. This has been observed in the ath12k mac ml station remove() function during disconnection and in the ath12k mac op set key() function during PTK key installation by wpa supplicant.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.