CVE-2026-74554

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. An out-of-bounds write vulnerability exists in the ath12k_mac_dp_peer_cleanup() function. This issue occurs due to incorrect indexing of a bitmap, leading to memory corruption adjacent to the bitmap. This could allow a malicious Wi-Fi peer to cause a denial of service or potentially achieve arbitrary code execution.

An out of bounds write in the ath12k MLO peer cleanup path occurs because clear_bit is called with dp_peer peer_id even though an MLO peer_id includes the ATH12K_PEER_ML_ID_VALID bit. This makes the bit index at least 0x2000 while free_ml_peer_id_map only covers 256 bits, so memory adjacent to the bitmap can be corrupted during peer cleanup. For the CVSS the PR:N is used because a nearby WiFi attacker may be able to influence MLO peer creation and teardown without a local account on the victim, assuming affected ath12k hardware and an exposed MLO capable wireless role. The issue is not Internet reachable but is adjacent network reachable over WiFi. Impact is at least denial of service and memory corruption. In the paranoid interpretation it may allow confidentiality and integrity impact or privilege escalation because the primitive is an out of bounds kernel memory bit clear rather than a pure NULL dereference or resource leak.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.