Bug 2517020 (CVE-2026-74554)

Summary: CVE-2026-74554 kernel: wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's ath12k Wi-Fi driver. An out-of-bounds write vulnerability exists in the `ath12k_mac_dp_peer_cleanup()` function. This issue occurs due to incorrect indexing of a bitmap, leading to memory corruption adjacent to the bitmap. This could allow a malicious Wi-Fi peer to cause a denial of service or potentially achieve arbitrary code execution.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 12:45:06 UTC 
In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()

ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the
free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is
wrong: dp_peer->peer_id for an MLO peer always carries the
ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with
index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS
(256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The
intended bitmap entry also never gets cleared, so subsequent
ath12k_peer_ml_alloc() calls eventually run out of IDs.

The ID without the VALID bit is what ath12k_peer_ml_alloc() returned and
is stored in ahsta->ml_peer_id. Use that instead.

While there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so
the bitmap and ahsta->ml_peer_id stay in sync.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Comment 1 Mauro Matteo Cascella 2026-08-21 08:14:10 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-74554-011f@gregkh/T