CVE-2026-46248 (GCVE-0-2026-46248)

Vulnerability from cvelistv5 – Published: 2026-06-03 15:49 – Updated: 2026-06-03 15:49
VLAI
Title
wifi: ath12k: clear stale link mapping of ahvif->links_map
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: clear stale link mapping of ahvif->links_map When an arvif is initialized in non-AP STA mode but MLO connection preparation fails before the arvif is created (arvif->is_created remains false), the error path attempts to delete all links. However, link deletion only executes when arvif->is_created is true. As a result, ahvif retains a stale entry of arvif that is initialized but not created. When a new arvif is initialized with the same link id, this stale mapping triggers the following WARN_ON. WARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k], CPU#3: wpa_supplicant/275 Call trace: ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k] (P) drv_change_vif_links+0xbc/0x1a4 [mac80211] ieee80211_vif_update_links+0x54c/0x6a0 [mac80211] ieee80211_vif_set_links+0x40/0x70 [mac80211] ieee80211_prep_connection+0x84/0x450 [mac80211] ieee80211_mgd_auth+0x200/0x480 [mac80211] ieee80211_auth+0x14/0x20 [mac80211] cfg80211_mlme_auth+0x90/0xf0 [cfg80211] nl80211_authenticate+0x32c/0x380 [cfg80211] genl_family_rcv_msg_doit+0xc8/0x134 Fix this issue by unassigning the link vif and clearing ahvif->links_map if arvif is only initialized but not created. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 81e4be30544ee7e8da80e9aae7acd69d3be6d05a , < da289440f04c93048d82d293b180f1cacdfee2d9 (git)
Affected: 81e4be30544ee7e8da80e9aae7acd69d3be6d05a , < acd8319e834be6790e449701cb6df0f636801977 (git)
Affected: 81e4be30544ee7e8da80e9aae7acd69d3be6d05a , < 2c1ba9c2adf0fda96eaaebd8799268a7506a8fc9 (git)
Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "da289440f04c93048d82d293b180f1cacdfee2d9",
              "status": "affected",
              "version": "81e4be30544ee7e8da80e9aae7acd69d3be6d05a",
              "versionType": "git"
            },
            {
              "lessThan": "acd8319e834be6790e449701cb6df0f636801977",
              "status": "affected",
              "version": "81e4be30544ee7e8da80e9aae7acd69d3be6d05a",
              "versionType": "git"
            },
            {
              "lessThan": "2c1ba9c2adf0fda96eaaebd8799268a7506a8fc9",
              "status": "affected",
              "version": "81e4be30544ee7e8da80e9aae7acd69d3be6d05a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: clear stale link mapping of ahvif-\u003elinks_map\n\nWhen an arvif is initialized in non-AP STA mode but MLO connection\npreparation fails before the arvif is created\n(arvif-\u003eis_created remains false), the error path attempts to delete all\nlinks. However, link deletion only executes when arvif-\u003eis_created is true.\nAs a result, ahvif retains a stale entry of arvif that is initialized but\nnot created.\n\nWhen a new arvif is initialized with the same link id, this stale mapping\ntriggers the following WARN_ON.\n\nWARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k], CPU#3: wpa_supplicant/275\n\nCall trace:\n ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k] (P)\n drv_change_vif_links+0xbc/0x1a4 [mac80211]\n ieee80211_vif_update_links+0x54c/0x6a0 [mac80211]\n ieee80211_vif_set_links+0x40/0x70 [mac80211]\n ieee80211_prep_connection+0x84/0x450 [mac80211]\n ieee80211_mgd_auth+0x200/0x480 [mac80211]\n ieee80211_auth+0x14/0x20 [mac80211]\n cfg80211_mlme_auth+0x90/0xf0 [cfg80211]\n nl80211_authenticate+0x32c/0x380 [cfg80211]\n genl_family_rcv_msg_doit+0xc8/0x134\n\nFix this issue by unassigning the link vif and clearing ahvif-\u003elinks_map\nif arvif is only initialized but not created.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T15:49:43.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/da289440f04c93048d82d293b180f1cacdfee2d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/acd8319e834be6790e449701cb6df0f636801977"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c1ba9c2adf0fda96eaaebd8799268a7506a8fc9"
        }
      ],
      "title": "wifi: ath12k: clear stale link mapping of ahvif-\u003elinks_map",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46248",
    "datePublished": "2026-06-03T15:49:43.934Z",
    "dateReserved": "2026-05-13T15:03:33.107Z",
    "dateUpdated": "2026-06-03T15:49:43.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46248",
      "date": "2026-07-28",
      "epss": "0.00121",
      "percentile": "0.02273"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46248\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-03T18:16:25.097\",\"lastModified\":\"2026-07-22T20:10:00.127\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: clear stale link mapping of ahvif-\u003elinks_map\\n\\nWhen an arvif is initialized in non-AP STA mode but MLO connection\\npreparation fails before the arvif is created\\n(arvif-\u003eis_created remains false), the error path attempts to delete all\\nlinks. However, link deletion only executes when arvif-\u003eis_created is true.\\nAs a result, ahvif retains a stale entry of arvif that is initialized but\\nnot created.\\n\\nWhen a new arvif is initialized with the same link id, this stale mapping\\ntriggers the following WARN_ON.\\n\\nWARNING: drivers/net/wireless/ath/ath12k/mac.c:4271 at ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k], CPU#3: wpa_supplicant/275\\n\\nCall trace:\\n ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k] (P)\\n drv_change_vif_links+0xbc/0x1a4 [mac80211]\\n ieee80211_vif_update_links+0x54c/0x6a0 [mac80211]\\n ieee80211_vif_set_links+0x40/0x70 [mac80211]\\n ieee80211_prep_connection+0x84/0x450 [mac80211]\\n ieee80211_mgd_auth+0x200/0x480 [mac80211]\\n ieee80211_auth+0x14/0x20 [mac80211]\\n cfg80211_mlme_auth+0x90/0xf0 [cfg80211]\\n nl80211_authenticate+0x32c/0x380 [cfg80211]\\n genl_family_rcv_msg_doit+0xc8/0x134\\n\\nFix this issue by unassigning the link vif and clearing ahvif-\u003elinks_map\\nif arvif is only initialized but not created.\\n\\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nwifi: ath12k: limpiar el mapeo de enlace obsoleto de ahvif-\u003elinks_map\\n\\nCuando un arvif es inicializado en modo STA no-AP pero la preparaci\u00f3n de la conexi\u00f3n MLO falla antes de que el arvif sea creado (arvif-\u003eis_created permanece falso), la ruta de error intenta eliminar todos los enlaces. Sin embargo, la eliminaci\u00f3n de enlaces solo se ejecuta cuando arvif-\u003eis_created es verdadero. Como resultado, ahvif retiene una entrada obsoleta de arvif que est\u00e1 inicializado pero no creado.\\n\\nCuando un nuevo arvif es inicializado con el mismo id de enlace, este mapeo obsoleto dispara el siguiente WARN_ON.\\n\\nADVERTENCIA: drivers/net/wireless/ath/ath12k/mac.c:4271 en ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k], CPU#3: wpa_supplicant/275\\n\\nTraza de llamada:\\n ath12k_mac_op_change_vif_links+0x140/0x180 [ath12k] (P)\\n drv_change_vif_links+0xbc/0x1a4 [mac80211]\\n ieee80211_vif_update_links+0x54c/0x6a0 [mac80211]\\n ieee80211_vif_set_links+0x40/0x70 [mac80211]\\n ieee80211_prep_connection+0x84/0x450 [mac80211]\\n ieee80211_mgd_auth+0x200/0x480 [mac80211]\\n ieee80211_auth+0x14/0x20 [mac80211]\\n cfg80211_mlme_auth+0x90/0xf0 [cfg80211]\\n nl80211_authenticate+0x32c/0x380 [cfg80211]\\n genl_family_rcv_msg_doit+0xc8/0x134\\n\\nSolucione este problema desasignando el vif de enlace y limpiando ahvif-\u003elinks_map si arvif solo est\u00e1 inicializado pero no creado.\\n\\nProbado en: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/mac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"81e4be30544ee7e8da80e9aae7acd69d3be6d05a\",\"lessThan\":\"da289440f04c93048d82d293b180f1cacdfee2d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"81e4be30544ee7e8da80e9aae7acd69d3be6d05a\",\"lessThan\":\"acd8319e834be6790e449701cb6df0f636801977\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"81e4be30544ee7e8da80e9aae7acd69d3be6d05a\",\"lessThan\":\"2c1ba9c2adf0fda96eaaebd8799268a7506a8fc9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/mac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.14\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.15\",\"versionEndExcluding\":\"6.18.14\",\"matchCriteriaId\":\"4CC7C285-4CAC-4ED0-BEF1-D65CD5BA4AD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"672A3E79-EC03-479D-8503-361DFBDC8092\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2c1ba9c2adf0fda96eaaebd8799268a7506a8fc9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/acd8319e834be6790e449701cb6df0f636801977\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da289440f04c93048d82d293b180f1cacdfee2d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:41:48+00:00",
      "cve": "CVE-2026-46248",
      "id": "CVE-2026-46248",
      "initial_release_date": "2026-06-03T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath12k: clear stale link mapping of ahvif-\u003elinks_map",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46248.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-06-05T03:08:28Z",
      "cve": "CVE-2026-46248",
      "id": "CVE-2026-46248",
      "initial_release_date": "2026-06-04T02:21:57Z",
      "product_status:known_not_affected": "227",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46248",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46248.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.