CVE-2026-74554

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds memory access occurs in the ath12k mac dp peer cleanup() function. The function attempts to clear a slot on the free ml peer id map bitmap using dp peer->peer id as an index. Because dp peer->peer id for an MLO peer includes the ATH12K PEER ML ID VALID bit, the clear bit() function is called with an index greater than or equal to 0x2000. This index exceeds the 256-bit size of the ATH12K MAX MLO PEERS bitmap, resulting in the corruption of memory adjacent to ah->free ml peer id map. Additionally, the intended bitmap entry remains uncleared, which eventually leads to a depletion of available IDs during subsequent ath12k peer ml alloc() calls.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.