# CVE-2026-74366: linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix NULL deref in change_sta_links...

CVE-2026-74366 is fixed in linux on 1 platform by DEBIAN-CVE-2026-74366 (version 7.1.5-1), released August 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-74366
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0021
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 15, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix NULL deref in change_sta_links for unready link  _ieee80211_set_active_links() calls _ieee80211_link_use_channel() for each newly-added link and WARN_ON_ONCE()s if it fails. The call uses assign_on_failure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drv_assign_vif_chanctx() is never reached. Since ath12k_mac_vdev_create() is only called from that path, arvif->is_created remains false and arvif->ar remains NULL for the failed link.  The subsequent drv_change_sta_links() call reaches ath12k_mac_op_change_sta_links(), which allocates an arsta and sets ahsta->links_map |= BIT(link_id) for the broken link before checking whether the link is ready. When the vdev was never created, only station_add() is skipped, but the link remains in links_map.  Any subsequent operation iterating links_map and dereferencing arvif->ar without a NULL check will crash. Two observed examples are NULL deref in ath12k_mac_ml_station_remove() on disconnect and in ath12k_mac_op_set_key() when wpa_supplicant installs PTK keys.    BUG: Unable to handle kernel NULL pointer dereference at 0x00000000   pc : ath12k_mac_station_post_remove+0x40/0xe8 [ath12k]   Call trace:    ath12k_mac_station_post_remove+0x40/0xe8 [ath12k]    ath12k_mac_op_sta_state+0xb60/0x1720 [ath12k]    drv_sta_state+0x100/0xbd8 [mac80211]    __sta_info_destroy_part2+0x148/0x178 [mac80211]    ieee80211_set_disassoc+0x500/0x678 [mac80211]    BUG: Unable to handle kernel NULL pointer dereference at 0x00000000   pc : ath12k_mac_op_set_key+0x1f8/0x2c0 [ath12k]   Call trace:    ath12k_mac_op_set_key+0x1f8/0x2c0 [ath12k]    drv_set_key+0x70/0x100 [mac80211]    ieee80211_key_enable_hw_accel+0x78/0x260 [mac80211]    ieee80211_add_key+0x16c/0x2ac [mac80211]    nl80211_new_key+0x138/0x280 [cfg80211]  Fix this by checking arvif->is_created before calling ath12k_mac_alloc_assign_link_sta(). This prevents the broken link from entering links_map, so all subsequent operations iterating the bitmap are protected. The reliability of arvif->is_created across all error paths is ensured by the preceding patch.  Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-74366](https://patchblox.com/security/data/fix/linux/debian-cve-2026-74366.md) | Aug 15, 2026 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.