Linux Kernel CVE-2026-74554

Exploitation requires the attacker to be physically within WiFi radio range or logically on the same Layer 2 WiFi segment as the target - internet-based remote exploitation is not possible given the Adjacent network vector. The target must be running a Linux kernel with the ath12k driver loaded and active on Qualcomm 802.11be (WiFi 7) hardware capable of Multi-Link Operation, such as the WCN7850 PCI chipset. No authentication or credentials are required once adjacency is established (CVSS PR:N). Systems without Qualcomm WiFi 7 hardware, or with the ath12k module absent or blacklisted, are entirely unaffected. Kernel security mitigations - SMEP, SMAP, heap randomization, and Control Flow Integrity - increase the complexity of converting the out-of-bounds write into reliable code execution beyond a denial-of-service condition.

The CVSS 8.8 rating with an Adjacent network vector (AV:A) significantly limits the realistic attacker population: exploitation requires physical or logical WiFi proximity, not open internet reachability. EPSS at 0.14% (4th percentile) indicates no observed exploitation telemetry, consistent with the absence of a CISA KEV listing and no known public proof-of-concept code. The memory corruption primitive is nevertheless technically serious: uncontrolled writes adjacent to kernel data structures can theoretically be developed into kernel code execution, though reliability depends heavily on heap layout and kernel hardening mitigations (SMEP, SMAP, heap randomization, CFI). The more immediately reproducible consequence - ML peer ID exhaustion causing denial of multi-link association - requires no sophisticated exploitation. Even a mid-sized municipal IT team in radom deploying Linux-based WiFi 7 infrastructure should treat this as a standard patch-cycle priority rather than an emergency, given the absence of observed exploitation and the constrained adjacency requirement. The CVSS vector (AV:A/AC:L/PR:N/UI:N) is consistent with the description: a WiFi-adjacent device can trigger the cleanup path without credentials, and the low complexity reflects that no special preconditions beyond adjacency are required.

An attacker within WiFi radio range of a device running a vulnerable ath12k-equipped Linux system initiates MLO peer association and then triggers repeated peer teardown cycles. Each cleanup call writes an out-of-bounds value - derived from the flagged peer ID 8192 or higher - into kernel memory beyond the 256-bit bitmap, progressively corrupting adjacent kernel structures. At minimum this causes ML peer ID exhaustion and denial of WiFi 7 multi-link service; with careful heap grooming and knowledge of kernel layout, the corruption primitive could be developed into kernel code execution, though no exploit demonstrating this has been identified.