CVE-2026-74367

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix inconsistent arvif state in vdev_create error paths

ath12k_mac_vdev_create() has three error path issues that leave arvif

in an inconsistent state:

1. When ath12k_wmi_vdev_create() fails, the function returns directly

without clearing arvif->ar, which was already set before the WMI

call. Subsequent code checking arvif->ar to determine vdev readiness

will see a non-NULL value despite no vdev existing in firmware.

2. When ath12k_wmi_send_peer_delete_cmd() fails in err_peer_del, the

code jumped to err: skipping the DP peer cleanup and vdev rollback,

leaving num_created_vdevs, vdev maps and arvif list membership live.

3. When ath12k_wait_for_peer_delete_done() fails, the code jumped to

err_vdev_del: skipping the DP peer cleanup.

Fix by changing the ath12k_wmi_vdev_create() failure to goto err instead

of returning directly, routing both err_peer_del failure paths through

err_dp_peer

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References