HIGH Introduced in 7.0
ath12k DpLinkPeer UAF
CVE-2026-93094
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback ath12k_mac_vdev_create() for an AP vdev creates the bss self-peer via ath12k_peer_create(), which finishes by calling ath12k_dp_link_peer_assign() to publish the dp_link_peer in the dp_hw->dp_peers[peerid_index] RCU table, in the dp_peer's link_peers[] array, and in the per-addr rhashtable. If a step after ath12k_peer_create() fails the function jumps to err_peer_del, which open-codes a WMI peer_delete and waits for the unmap / delete_resp events. The wait_for_peer_delete_done() path relies on ath12k_dp_link_peer_unmap_event() freeing the dp_link_peer when the unmap arrives, but err_peer_del never calls ath12k_dp_link_peer_unassign() first. The published references in the dp_hw RCU table, dp_peer->link_peers[] and the rhashtable are left pointing at the dp_link_peer that unmap_event then frees, producing dangling pointers and use-after-free on subsequent lookups. Replace the open-coded sequence with a call to ath12k_peer_delete(), which already does ath12k_dp_link_peer_unassign() before sending the WMI command. This drops the published references before the dp_link_peer is freed, in the same order as the normal teardown path in ath12k_mac_remove_link_interface(). Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the Linux kernel's ath12k WiFi driver during AP vdev creation rollback. When a step after peer creation fails, the error path frees a data path link peer object without first removing published references from RCU tables, link arrays, and a hash table, leaving dangling pointers that can be dereferenced on subsequent lookups. A local attacker with low privileges who can trigger the failure path could exploit this to cause memory corruption, potentially leading to privilege escalation or denial of service.
Vulnerability analysis
During AP vdev creation in the ath12k WiFi driver, a self-peer is created and published into several lookup structures. If a later step fails, the error-handling path sends a firmware delete command and waits for the unmap event, which frees the peer object—but it never removes the published references first. This leaves dangling pointers in the RCU lookup table, the link-peer array, and the address hash table, so any subsequent lookup can dereference freed memory. The fix replaces the open-coded error sequence with the standard peer-delete helper, which removes all published references before the object is freed, matching the normal teardown order. The vulnerable path is reached locally by configuring a WiFi access-point interface on ath12k hardware, so an attacker needs a local account with privileges to bring up or configure the wireless interface.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.6 | af405d216316 |
| mainline | 7.0 | 7.3 | f066e1a93703 |