CVE-2026-74367 wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
Inconsistent state in ath12k WiFi driver error paths can lead to system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74367?
CVE-2026-74367 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
ath12k_mac_vdev_create() has three error path issues that leave arvif in an inconsistent state:
1. When ath12k_wmi_vdev_create() fails, the function returns directly without clearing arvif->ar, which was already set before the WMI call. Subsequent code checking arvif->ar to determine vdev readiness will see a non-NULL value despite no vdev existing in firmware.
2. When ath12k_wmi_send_peer_delete_cmd() fails in err_peer_del, the code jumped to err: skipping the DP peer cleanup and vdev rollback, leaving num_created_vdevs, vdev maps and arvif list membership live.
3. When ath12k_wait_for_peer_delete_done() fails, the code jumped to err_vdev_del: skipping the DP peer cleanup.
Fix by changing the ath12k_wmi_vdev_create() failure to goto err instead of returning directly, routing both err_peer_del failure paths through err_dp_peer_del: for proper DP peer and vdev rollback, and consolidating the arvif state cleanup at err:.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Which versions are affected by CVE-2026-74367?
How do I fix CVE-2026-74367?
Apply the vendor's patch.
Is CVE-2026-74367 being exploited?
There is no known exploitation of CVE-2026-74367 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74367, DEBIAN-CVE-2026-74367, GHSA-cww3-p2pw-g5j8, UBUNTU-CVE-2026-74367.