What is the CVSS score of CVE-2026-74367?

CVE-2026-74367 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel ath12k are affected by CVE-2026-74367?

A kernel memory corruption vulnerability in the Linux ath12k Qualcomm WiFi 7 driver (CVE-2026-74367, CVSS 7.8) allows local low-privileged users to trigger information disclosure, system crashes, and…

How to fix or mitigate CVE-2026-74367?

Within 24 hours, identify and inventory systems running the ath12k driver, particularly those deploying Qualcomm WiFi 7 hardware. Within 7 days, implement access controls to restrict unprivileged user interaction with the driver via kernel module parameters and mandatory access control policies (AppArmor or SELinux); consider disabling the ath12k driver on non-critical systems where alternative WiFi connectivity exists. Within 30 days, establish monitoring for vendor security advisories and Linux kernel updates, evaluate alternative WiFi 7 drivers if available, and prepare a patch deployment plan for when the vendor releases a fix.

Linux Kernel ath12k CVE-2026-74367

EUVD-2026-59514 HIGH

2026-08-15 Linux

GHSA-cww3-p2pw-g5j8

Information Disclosure Linux Red Hat

High

Disputed · 7.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H because reliable triggering requires specific Qualcomm WCN7850 hardware AND a WMI call failure condition not easily controlled by the attacker.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:51 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

CVE Published

Aug 15, 2026 - 05:58 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:58 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix inconsistent arvif state in vdev_create error paths

ath12k_mac_vdev_create() has three error path issues that leave arvif in an inconsistent state:

When ath12k_wmi_vdev_create() fails, the function returns directly

without clearing arvif->ar, which was already set before the WMI call. Subsequent code checking arvif->ar to determine vdev readiness will see a non-NULL value despite no vdev existing in firmware.

When ath12k_wmi_send_peer_delete_cmd() fails in err_peer_del, the

code jumped to err: skipping the DP peer cleanup and vdev rollback, leaving num_created_vdevs, vdev maps and arvif list membership live.

When ath12k_wait_for_peer_delete_done() fails, the code jumped to

err_vdev_del: skipping the DP peer cleanup.

Fix by changing the ath12k_wmi_vdev_create() failure to goto err instead of returning directly, routing both err_peer_del failure paths through err_dp_peer_del: for proper DP peer and vdev rollback, and consolidating the arvif state cleanup at err:.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

AnalysisAI

Inconsistent arvif state management in the Linux kernel's ath12k Qualcomm WiFi 7 driver exposes local low-privileged users to kernel memory corruption, information disclosure, and system crash via stale pointer dereference. Three distinct error paths in ath12k_mac_vdev_create() fail to clear or properly unwind arvif->ar and associated vdev/peer state, leaving the driver operating against ghost structures never confirmed in firmware. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain local shell (PR:L)

Delivery

Load or confirm ath12k driver on WCN7850 hardware

Exploit

Trigger vdev creation via netlink/iw commands

Install

Induce WMI call failure (resource pressure or firmware error)

Stale arvif->ar pointer left in kernel

Execute

Dereference stale pointer in subsequent driver call

Impact

Kernel memory corruption or crash

Recon

Gain local shell (PR:L)

Delivery

Load or confirm ath12k driver on WCN7850 hardware

Exploit

Trigger vdev creation via netlink/iw commands

Install

Induce WMI call failure (resource pressure or firmware error)

Stale arvif->ar pointer left in kernel

Execute

Dereference stale pointer in subsequent driver call

Impact

Kernel memory corruption or crash

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following: (1) physical or shell-level local access to a Linux system running an unpatched kernel in the 6.13 series or the affected 477cabfdb776-based commit range; (2) the system must have Qualcomm WCN7850-class (WiFi 7, PCI) hardware with the ath12k driver loaded - this is not a software-only condition; (3) the attacker must be able to trigger WiFi virtual interface (vdev) creation, which typically requires CAP_NET_ADMIN or an equivalent namespace-scoped capability; (4) the WMI vdev creation or peer delete command must fail during that operation, either through deliberate resource exhaustion, crafted firmware interaction, or hardware error - this is not reliably triggerable without hardware-level influence. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) rates this High, but real-world risk is considerably narrower than the score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user with a low-privilege shell account on a Linux system equipped with a Qualcomm WCN7850 WiFi adapter creates and destroys virtual WiFi interfaces in rapid succession or under conditions that induce WMI call failure (e.g., firmware stress, resource exhaustion). The stale arvif->ar pointer left by a failed ath12k_wmi_vdev_create() is subsequently dereferenced by driver code checking vdev readiness, leading to a kernel use-after-free or null pointer dereference that can crash the system or, under controlled exploitation, redirect kernel execution. …
Remediation	The primary fix is to apply the upstream stable commits: e0140e094b196d92f2a4ce167ee73cbfab000290 and c972636efc63f0f43d725b59805dd1ae5bc4b31e, available at https://git.kernel.org/stable/c/e0140e094b196d92f2a4ce167ee73cbfab000290 and https://git.kernel.org/stable/c/c972636efc63f0f43d725b59805dd1ae5bc4b31e respectively. … Detailed patch versions, workarounds, and compensating controls in full report.