CVE-2026-46248: Linux ath12k WiFi Driver Link Mapping Denial of Service

Technical summary

CVE-2026-46248 is a logic error in the ath12k WiFi driver's multi-link operation (MLO) initialization path. When an arvif (Atheros virtual interface) is initialized in non-AP STA mode but MLO connection preparation fails before arvif->is_created is set to true, the error handling path skips link deletion. This occurs because link deletion is guarded by the is_created flag. Consequently, ahvif->links_map retains a stale entry pointing to an initialized-but-not-created arvif. Upon subsequent connection attempts using the same link ID, a new arvif initialization collides with the stale mapping, triggering a WARN_ON at ath12k_mac_op_change_vif_links(). The fix clears the ahvif->links_map entry and unassigns the link vif when arvif remains uninitialized after failure, ensuring the mapping state stays consistent.

Business impact

Systems running affected ath12k-based WiFi hardware may experience WiFi instability or disconnections during multi-link operation, particularly in environments where connections fail and retry frequently (e.g., mobile devices, roaming scenarios). While not a direct security breach, the resulting denial-of-service condition impacts network availability and user experience. Organizations relying on Linux systems with ath12k chipsets—including some enterprise laptops and edge devices—should treat this as a reliability issue affecting wireless connectivity.

Affected systems

The Linux kernel ath12k WiFi driver is affected. This driver supports Qualcomm Atheros ath12k wireless chipsets, including the QCN9274 hw2.0 (the tested platform noted in the advisory). Any Linux system or device using ath12k for WiFi connectivity is potentially impacted, including enterprise Linux distributions, embedded systems, and mobile devices running Linux-based OSes. Exact kernel version ranges are not specified in the advisory; administrators should consult the Linux kernel security tracker and their distributor for affected versions.

Exploitability

Exploitation requires local access (AV:L) and user-level privileges (PR:L). An unprivileged local user can trigger the vulnerability by initiating WiFi connection attempts that fail during MLO setup, causing repeated link ID reuse. No special tools or network access are needed—standard WiFi connection mechanisms are sufficient. The vulnerability is not remotely exploitable and does not require elevated privileges, though the impact is primarily denial-of-service (WiFi unavailability) rather than data exfiltration or privilege escalation.

Remediation

Apply the Linux kernel patch that clears stale link mappings in the ath12k driver's error path. The fix ensures ahvif->links_map is unassigned when an arvif fails to initialize. Administrators should update their Linux kernel to a version that includes this fix; consult your distribution's security advisories and the Linux kernel stable release notes for the specific version containing the patch. No workaround exists; kernel update is the only mitigation.

Patch guidance

Patch availability depends on your Linux distribution and kernel version. Check your distributor's security advisory for CVE-2026-46248 to determine the patched kernel version. For users tracking mainline Linux, verify that the fix commit resolving the ath12k link mapping issue is included in your kernel version (typically in stable releases following the fix merge). Test WiFi connectivity, particularly multi-link operation scenarios, after patching to confirm proper operation. Rollback is not recommended except in cases of regression; this is a defensive fix addressing a rare error path.

Detection guidance

Monitor kernel logs for WARN_ON messages originating from ath12k_mac_op_change_vif_links() in drivers/net/wireless/ath/ath12k/mac.c, particularly at line 4271. Unexpected WiFi disconnections or repeated connection failures during MLO setup may indicate the stale link mapping issue. Use dmesg or journalctl to inspect system logs on affected systems. On production systems, configure log aggregation to flag these warnings for investigation. Note that the warning itself is harmless once the patch is applied; it was the symptom of underlying state corruption.

Why prioritize this

While the CVSS score of 5.5 (MEDIUM) reflects the local attack surface and denial-of-service nature, this should be prioritized based on your deployment profile. Organizations with heavy ath12k chipset usage in Linux environments—particularly those supporting mobile or roaming deployments—should patch promptly. The reliability impact on WiFi connectivity justifies near-term scheduling. Conversely, data-center-focused environments with primarily Ethernet infrastructure may defer patching to the next routine maintenance window.

Risk score, explained

The CVSS v3.1 score of 5.5 (MEDIUM) reflects an attack vector limited to local access (AV:L), low attack complexity (AC:L), and user-level privileges (PR:L), with no user interaction required (UI:N). The impact is confined to availability (A:H), with no confidentiality or integrity damage (C:N, I:N). The scope is unchanged (S:U). The score appropriately captures a local reliability issue but understates the practical impact for WiFi-dependent workflows; prioritization should factor in organizational reliance on wireless connectivity.

Frequently asked questions