CVE-2026-74368
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the NWIFI header length is invalid, causing the function to abort early with -EINVAL.
When this happens, the error propagates to ath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it to NULL. As a result, the corresponding MSDU is no longer referenced by the defragmentation path and is never freed.
This leads to a memory leak for the affected MSDU on this error path. Proper cleanup is required to ensure the MSDU is released when header validation fails during TKIP MIC verification.
Leer descripción completaMostrar menos
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.20%
- Percentil entre todas las CVEs puntuadas: 9
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-74368",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9a0dddfb30f120db3851627935851d262e4e7acb",
"lessThan": "5187a92099778501f21af76ed6c8415d128e7298",
"versionType": "git"
},
{
"status": "affected",
"version": "9a0dddfb30f120db3851627935851d262e4e7acb",
"lessThan": "98d4f92ab6a1af2ea2ab590d7e2801b203110981",
"versionType": "git"
},
{
"status": "affected",
"version": "7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c",
"versionType": "git"
},
{
"status": "affected",
"version": "3abe15e756481c45f6acba3d476cb3ca4afc3b61",
"versionType": "git"
},
{
"status": "affected",
"version": "6ee653194ddb83674913fd2727b8ecfae0597ade",
"versionType": "git"
},
{
"status": "affected",
"version": "50be1fb76556e80af9f5da80f28168b6c71bce58",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.88",
"lessThan": "6.7",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.24",
"lessThan": "6.13",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.13.12",
"lessThan": "6.14",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.14.3",
"lessThan": "6.15",
"versionType": "semver"
}
],
"programFiles": [
"drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-15T06:22:38.530",
"references": [
{
"url": "https://git.kernel.org/stable/c/5187a92099778501f21af76ed6c8415d128e7298",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()\n\nIn ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to\nath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the\nNWIFI header length is invalid, causing the function to abort early with\n-EINVAL.\n\nWhen this happens, the error propagates to\nath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it\nto NULL. As a result, the corresponding MSDU is no longer referenced\nby the defragmentation path and is never freed.\n\nThis leads to a memory leak for the affected MSDU on this error path.\nProper cleanup is required to ensure the MSDU is released when header\nvalidation fails during TKIP MIC verification.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3"
}
],
"lastModified": "2026-08-17T06:19:31.653",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}