Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is wrong: dp_peer->peer_id for an MLO peer always carries the ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS (256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The intended bitmap entry also never gets cleared, so subsequent ath12k_peer_ml_alloc() calls eventually run out of IDs. The ID without the VALID bit is what ath12k_peer_ml_alloc() returned and is stored in ahsta->ml_peer_id. Use that instead. While there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so the bitmap and ahsta->ml_peer_id stay in sync. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:18:00.830Z",
  "pubdate": "2026-08-15T13:18:00.830Z",
  "executiveSummary": "An out-of-bounds memory corruption vulnerability exists in the Linux kernel ath12k wireless driver, specifically within the ath12k_mac_dp_peer_cleanup() function.\nThe vulnerability is classified as an out-of-bounds write resulting from improper index validation when clearing bits in a management bitmap.\nThe flaw allows memory corruption adjacent to the ah->free_ml_peer_id_map structure due to indexing with a peer ID containing the ATH12K_PEER_ML_ID_VALID bit (BIT(13)), which exceeds the maximum bitmap size of 256 bits.\nImpact includes kernel memory corruption, potential denial of service through resource exhaustion of Multi-Link Operation (MLO) peer IDs, and potential arbitrary kernel execution depending on adjacent memory layout.\nThe affected product is the Linux kernel utilizing the ath12k driver for hardware such as the WCN7850 chipset.\nExploitation requires local execution context or wireless driver interactions capable of triggering peer cleanup routines, though specific remote attack vectors are contingent on driver exposure and wireless frame handling.",
  "technicalDetails": "The root cause of the vulnerability resides in ath12k_mac_dp_peer_cleanup() within the ath12k wireless driver of the Linux kernel.\nDuring the cleanup phase of Multi-Link Operation (MLO) peers, the function attempts to release a previously allocated peer ID by clearing the corresponding bit in the free_ml_peer_id_map bitmap.\nThe function incorrectly indexes the bitmap using dp_peer->peer_id directly.\nFor MLO peers, dp_peer->peer_id always carries the ATH12K_PEER_ML_ID_VALID bit (BIT(13)), resulting in an index value greater than or equal to 0x2000.\nBecause the free_ml_peer_id_map bitmap is sized for ATH12K_MAX_MLO_PEERS (256 bits), providing an index of 0x2000 or greater causes clear_bit() to access memory far outside the intended boundaries of the bitmap.\nThis out-of-bounds memory access leads directly to the corruption of adjacent kernel memory structures located near ah->free_ml_peer_id_map.\nFurthermore, the intended bitmap entry is never actually cleared, causing subsequent calls to ath12k_peer_ml_alloc() to eventually run out of available IDs, resulting in a resource exhaustion denial of service condition.\nThe correct implementation requires using the raw ID without the VALID bit, which is originally returned by ath12k_peer_ml_alloc() and stored in ahsta->ml_peer_id.\nAdditionally, failure to reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID exacerbates state desynchronization between the tracking variables and the bitmap.\nExploitation occurs step-by-step as follows: an MLO peer is established and subsequently torn down, triggering ath12k_mac_dp_peer_cleanup(); the driver reads the tainted dp_peer->peer_id containing the validation bit; clear_bit() evaluates the out-of-bounds index; adjacent kernel heap memory is overwritten; and internal state tracking becomes permanently desynchronized."
}