{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix NULL deref in change_sta_links for unready link  _ieee80211_set_active_links() calls _ieee80211_link_use_channel() for each newly-added link and WARN_ON_ONCE()s if it fails. The call uses assign_on_failure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drv_assign_vif_chanctx() is never reached. Since ath12k_mac_vdev_create() is only called from that path, arvif-\u003eis_created remains false and arvif-\u003ear remains NULL for the failed link.  The subsequent drv_change_sta_links() call reaches ath12k_mac_op_change_sta_links(), which allocates an arsta and sets ahsta-\u003elinks_map |= BIT(link_id) for the broken link before checking whether the link is ready. When the vdev was never created, only station_add() is skipped, but the link remains in links_map.  Any subsequent operation iterating links_map and dereferencing arvif-\u003ear without a NULL check will crash. Two observed examples are NULL deref in ath12k_mac_ml_station_remove() on disconnect and in ath12k_mac_op_set_key() when wpa_supplicant installs PTK keys.    BUG: Unable to handle kernel NULL pointer dereference at 0x00000000   pc : ath12k_mac_station_post_remove+0x40/0xe8 [ath12k]   Call trace:    ath12k_mac_station_post_remove+0x40/0xe8 [ath12k]    ath12k_mac_op_sta_state+0xb60/0x1720 [ath12k]    drv_sta_state+0x100/0xbd8 [mac80211]    __sta_info_destroy_part2+0x148/0x178 [mac80211]    ieee80211_set_disassoc+0x500/0x678 [mac80211]    BUG: Unable to handle kernel NULL pointer dereference at 0x00000000   pc : ath12k_mac_op_set_key+0x1f8/0x2c0 [ath12k]   Call trace:    ath12k_mac_op_set_key+0x1f8/0x2c0 [ath12k]    drv_set_key+0x70/0x100 [mac80211]    ieee80211_key_enable_hw_accel+0x78/0x260 [mac80211]    ieee80211_add_key+0x16c/0x2ac [mac80211]    nl80211_new_key+0x138/0x280 [cfg80211]  Fix this by checking arvif-\u003eis_created before calling ath12k_mac_alloc_assign_link_sta(). This prevents the broken link from entering links_map, so all subsequent operations iterating the bitmap are protected. The reliability of arvif-\u003eis_created across all error paths is ensured by the preceding patch.  Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3",
  "id": "DEBIAN-CVE-2026-74366",
  "modified": "2026-08-17T08:47:41.158874587Z",
  "published": "2026-08-15T06:22:38.287Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74366"
    }
  ],
  "upstream": [
    "CVE-2026-74366"
  ]
}