CVE-2026-46248

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: clear stale link mapping of ahvif->links_map

When an arvif is initialized in non-AP STA mode but MLO connection

preparation fails before the arvif is created

(arvif->is_created remains false), the error path attempts to delete all

links. However, link deletion only executes when arvif->is_created is true.

As a result, ahvif retains a stale entry of arvif that is initialized but

not created.

When a new arvif is initialized with the same link id, this stale mapping

triggers the following WARN_ON.

WARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k], CPU#3: wpa_supplicant/275

Call trace:

ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k] (P)

drv_change_vif_links+0xbc/0x1a4 [mac80211]

ieee80211_vif_update_links+0x54c/0x6a0 [mac80211]

ieee80211_vif_set_links+0x40/0x70 [mac80211]

ieee80211_prep_connection+0x84/0x450 [mac80211]

ieee80211_mgd_auth+

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References