Cloudanix VulnDB

CVE-2026-93094

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain WiFi hardware drivers on Linux could let a local attacker crash the system or run code with higher privileges if wireless access point setup fails partway through.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free due to dangling references in the ath12k driver's dp_hw RCU table, dp_peer link_peers array, and per-address rhashtable after a failed AP vdev peer creation rollback; the open-coded WMI peer_delete leaves pointers to a freed dp_link_peer structure.

Why it matters to the business

Potential kernel crashes, memory corruption, or local privilege escalation on affected Linux systems running ath12k WiFi hardware, which could disrupt wireless connectivity or allow attackers to gain elevated access on devices using this driver.

How an attack unfolds

An attacker with local access triggers ath12k_mac_vdev_create for an AP vdev where a post-peer_create step fails, causing the err_peer_del path to delete the peer without first unassigning the dp_link_peer references; subsequent lookups then dereference the freed structure, leading to use-after-free.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the open-coded peer delete sequence with a call to ath12k_peer_delete which properly invokes ath12k_dp_link_peer_unassign before the WMI command.

How to confirm the fix worked

Confirm the kernel source contains the corrected ath12k_mac_vdev_create error path that calls ath12k_peer_delete instead of the open-coded WMI sequence; test by exercising AP vdev creation failure scenarios and verifying no dangling references remain.

Typical attack path

  1. Obtain local execution on a system using ath12k hardware
  2. Trigger AP vdev creation that succeeds at peer creation but fails on a later step
  3. Force the err_peer_del rollback path that performs open-coded WMI delete without unassign
  4. Perform subsequent peer lookups that dereference the now-freed dp_link_peer

How to detect it

Review kernel logs for ath12k peer creation and deletion sequences around vdev rollback events; look for use-after-free warnings or crashes referencing dp_link_peer or ath12k_dp_link_peer structures.

What your security team should do

  • Prioritize kernel updates for any systems exposing ath12k WiFi in AP mode
  • Monitor upstream wireless-next and distribution kernels for the backported fix
  • Limit exposure by restricting local user access on affected devices until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback ath12k_mac_vdev_create() for an AP vdev creates the bss self-peer via ath12k_peer_create(), which finishes by calling ath12k_dp_link_peer_assign() to publish the dp_link_peer in the dp_hw->dp_peers[peerid_index] RCU table, in the dp_peer's link_peers[] array, and in the per-addr rhashtable. If a step after ath12k_peer_create() fails the function jumps to err_peer_del, which open-codes a WMI peer_delete and waits for the unmap / delete_resp events. The wait_for_peer_delete_done() path relies on ath12k_dp_link_peer_unmap_event() freeing the dp_link_peer when the unmap arrives, but err_peer_del never calls ath12k_dp_link_peer_unassign() first. The published references in the dp_hw RCU table, dp_peer->link_peers[] and the rhashtable are left pointing at the dp_link_peer that unmap_event then frees, producing dangling pointers and use-after-free on subsequent lookups. Replace the open-coded sequence with a call to ath12k_peer_delete(), which already does ath12k_dp_link_peer_unassign() before sending the WMI command. This drops the published references before the dp_link_peer is freed, in the same order as the normal teardown path in ath12k_mac_remove_link_interface(). Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3

Affected packages

Ecosystem Package Introduced Fixed