CVE-2026-93094

A flaw was found in the ath12k Wi-Fi driver of the Linux kernel. This vulnerability occurs during the rollback of an Access Point (AP) virtual device (vdev) creation. If a peer creation step fails, the system can improperly free memory while still holding references to it, leading to a use-after-free condition. This can result in system instability or potentially allow an attacker to execute arbitrary code.

A use after free condition can occur in the ath12k AP vdev rollback path because dp_link_peer remains published in the RCU peer table, the dp_peer link_peers array, and the per address rhashtable after the object is freed by the unmap event. Later peer lookups can dereference stale pointers and may crash the kernel. For the CVSS the PR:L is used for the paranoid score because reliable triggering normally requires local control over AP or vdev setup, but this control may be delegated to a network management service, container, or reduced capability account rather than full host root. The issue is not directly network reachable as an initial trigger, although wireless traffic or later driver activity may exercise the stale references once the bad rollback state exists. Impact is at least local denial of service via kernel crash. In worst case it may allow confidentiality or integrity impact due to kernel UAF style memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.