Out-of-Bounds Memory Vulnerability in Linux Kernel's ath12k Component

CVE-2026-74554

What is CVE-2026-74554?

A critical vulnerability exists in the Linux kernel's ath12k component that allows for out-of-bounds memory access. This flaw is triggered in the ath12k_mac_dp_peer_cleanup() function, where an incorrect indexing method uses dp_peer->peer_id, potentially leading to memory corruption. The issue arises due to the peer ID for MLO peers always carrying the ATH12K_PEER_ML_ID_VALID bit, resulting in an index that exceeds the allocated bitmap for maximum MLO peers. This misuse of the clear_bit() function can damage adjacent memory and disrupt subsequent allocations, leading to potential instability and a depletion of valid IDs. Mitigation steps involve appropriately resetting variables to ensure synchronization within the system.

References