SB2026060438 - Improper control of a resource through its lifetime in Linux kernel ath ath12k driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46248)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in ath12k_mac_op_change_vif_links and ahvif->links_map when handling failed MLO connection preparation in non-AP STA mode. A local user can trigger authentication handling that reuses the same link id to cause a denial of service.

The issue occurs when an arvif is initialized but not created, leaving a stale link mapping that can trigger a WARN_ON.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2c1ba9c2adf0fda96eaaebd8799268a7506a8fc9
• https://git.kernel.org/stable/c/acd8319e834be6790e449701cb6df0f636801977
• https://git.kernel.org/stable/c/da289440f04c93048d82d293b180f1cacdfee2d9