CVE-2026-74368
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the NWIFI header length is invalid, causing the function to abort early with -EINVAL. When this happens, the error propagates to ath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it to NULL. As a result, the corresponding MSDU is no longer referenced by the defragmentation path and is never freed. This leads to a memory leak for the affected MSDU on this error path. Proper cleanup is required to ensure the MSDU is released when header validation fails during TKIP MIC verification. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-15 06:22:38.530000
Last modified
2026-10-21 13:19:43.017000
View original CVE JSON
{
"id": "CVE-2026-74368",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-08-15T06:22:38.530",
"lastModified": "2026-10-21T13:19:43.017",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()\n\nIn ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to\nath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the\nNWIFI header length is invalid, causing the function to abort early with\n-EINVAL.\n\nWhen this happens, the error propagates to\nath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it\nto NULL. As a result, the corresponding MSDU is no longer referenced\nby the defragmentation path and is never freed.\n\nThis leads to a memory leak for the affected MSDU on this error path.\nProper cleanup is required to ensure the MSDU is released when header\nvalidation fails during TKIP MIC verification.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3"
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c",
"lessThan": "d960cd5dbcc6a01f49cc304b724f6b18a63a172d",
"versionType": "git",
"status": "affected"
},
{
"version": "3abe15e756481c45f6acba3d476cb3ca4afc3b61",
"lessThan": "779ab501dc8f1148b3f10740a68335741bdc5ffe",
"versionType": "git",
"status": "affected"
},
{
"version": "9a0dddfb30f120db3851627935851d262e4e7acb",
"lessThan": "55c6f05b667726d2da5fd011d646fb48ce5b6b9c",
"versionType": "git",
"status": "affected"
},
{
"version": "9a0dddfb30f120db3851627935851d262e4e7acb",
"lessThan": "5187a92099778501f21af76ed6c8415d128e7298",
"versionType": "git",
"status": "affected"
},
{
"version": "9a0dddfb30f120db3851627935851d262e4e7acb",
"lessThan": "98d4f92ab6a1af2ea2ab590d7e2801b203110981",
"versionType": "git",
"status": "affected"
},
{
"version": "6ee653194ddb83674913fd2727b8ecfae0597ade",
"versionType": "git",
"status": "affected"
},
{
"version": "50be1fb76556e80af9f5da80f28168b6c71bce58",
"versionType": "git",
"status": "affected"
},
{
"version": "6.6.88",
"lessThan": "6.6.160",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.12.24",
"lessThan": "6.12.114",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.13.12",
"lessThan": "6.14",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.14.3",
"lessThan": "6.15",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.15",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.15",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.114",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.57",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.5",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/5187a92099778501f21af76ed6c8415d128e7298",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/55c6f05b667726d2da5fd011d646fb48ce5b6b9c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/779ab501dc8f1148b3f10740a68335741bdc5ffe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d960cd5dbcc6a01f49cc304b724f6b18a63a172d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}