GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46271 (GCVE-0-2026-46271)

Vulnerability from cvelistv5 – Published: 2026-06-03 15:50 – Updated: 2026-08-05 12:30
VLAI
Title
wifi: ath12k: do WoW offloads only on primary link
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads only on primary link In case of multi-link connection, WCN7850 firmware crashes due to WoW offloads enabled on both primary and secondary links. Change to do it only on primary link to fix it. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 32f7b19668bd2894f1a236580c2132fc4b9f4449 , < 7379837c3f9efa576dc2d716ebfaa3a113b3112f (git)
Affected: 32f7b19668bd2894f1a236580c2132fc4b9f4449 , < e042da1085d9f1686c58a4378d5840f52a36598e (git)
Affected: 32f7b19668bd2894f1a236580c2132fc4b9f4449 , < e62102ac9b773bdb08475aa9ca24dea61ae98708 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/wow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7379837c3f9efa576dc2d716ebfaa3a113b3112f",
              "status": "affected",
              "version": "32f7b19668bd2894f1a236580c2132fc4b9f4449",
              "versionType": "git"
            },
            {
              "lessThan": "e042da1085d9f1686c58a4378d5840f52a36598e",
              "status": "affected",
              "version": "32f7b19668bd2894f1a236580c2132fc4b9f4449",
              "versionType": "git"
            },
            {
              "lessThan": "e62102ac9b773bdb08475aa9ca24dea61ae98708",
              "status": "affected",
              "version": "32f7b19668bd2894f1a236580c2132fc4b9f4449",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/wow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: do WoW offloads only on primary link\n\nIn case of multi-link connection, WCN7850 firmware crashes due to WoW\noffloads enabled on both primary and secondary links.\n\nChange to do it only on primary link to fix it.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code runs only in ath12k_wow_op_suspend during system suspend with WoW enabled, reached via wiphy PM \u2192 cfg80211 \u2192 mac80211 drv_suspend, not via remote WiFi frame handling.\nAC:L - On affected WCN7850 hardware, a local attacker (or rogue MLO AP plus victim suspend) can reliably trigger the path by associating over MLO and invoking suspend while wowlan is configured; no uncontrollable race or rare layout is required.\nPR:L - Exploitation requires local suspend capability (typical session/logind user) and an active WoW configuration (often pre-set by NetworkManager; otherwise NL80211_CMD_SET_WOWLAN needs CAP_NET_ADMIN, obtainable in a user network namespace).\nUI:N - Suspend/WoW entry is commonly driven by automatic system power management without a separate deliberate user security action beyond normal laptop use.\nS:U - Impact is confined to the WiFi driver/firmware stack on the same host; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Although the immediate fault is firmware-side, the failure mode cannot rule out disclosure via corrupted firmware/host DMA or WMI shared buffers; per conservative scoring, treat closed firmware memory faults as potential arbitrary read when impact is uncertain.\nI:H - Duplicate WoW offload WMI on multiple MLO vdevs corrupts firmware state; when exploitation path to host integrity is uncertain, score High because firmware compromise over PCIe may enable control of host-visible rings and descriptors.\nA:H - The commit documents WCN7850 firmware crash when WoW offloads are enabled on both MLO links, causing WiFi subsystem failure and broken or wedged suspend/resume on affected devices."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:55.666Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7379837c3f9efa576dc2d716ebfaa3a113b3112f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e042da1085d9f1686c58a4378d5840f52a36598e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e62102ac9b773bdb08475aa9ca24dea61ae98708"
        }
      ],
      "title": "wifi: ath12k: do WoW offloads only on primary link",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46271",
    "datePublished": "2026-06-03T15:50:13.645Z",
    "dateReserved": "2026-05-13T15:03:33.109Z",
    "dateUpdated": "2026-08-05T12:30:55.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46271",
      "date": "2026-09-16",
      "epss": "0.00119",
      "percentile": "0.02003"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46271\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-03T18:16:28.897\",\"lastModified\":\"2026-07-22T20:10:00.127\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: do WoW offloads only on primary link\\n\\nIn case of multi-link connection, WCN7850 firmware crashes due to WoW\\noffloads enabled on both primary and secondary links.\\n\\nChange to do it only on primary link to fix it.\\n\\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nwifi: ath12k: realizar descargas WoW solo en el enlace principal\\n\\nEn caso de conexi\u00f3n multi-enlace, el firmware de WCN7850 se bloquea debido a las descargas WoW habilitadas tanto en los enlaces primario como secundario.\\n\\nCambio para hacerlo solo en el enlace principal para solucionarlo.\\n\\nProbado en: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/wow.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"32f7b19668bd2894f1a236580c2132fc4b9f4449\",\"lessThan\":\"7379837c3f9efa576dc2d716ebfaa3a113b3112f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32f7b19668bd2894f1a236580c2132fc4b9f4449\",\"lessThan\":\"e042da1085d9f1686c58a4378d5840f52a36598e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32f7b19668bd2894f1a236580c2132fc4b9f4449\",\"lessThan\":\"e62102ac9b773bdb08475aa9ca24dea61ae98708\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/wow.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.14\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.18.14\",\"matchCriteriaId\":\"974ECCCC-3CBB-4A66-9A34-82621077D7F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"672A3E79-EC03-479D-8503-361DFBDC8092\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7379837c3f9efa576dc2d716ebfaa3a113b3112f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e042da1085d9f1686c58a4378d5840f52a36598e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e62102ac9b773bdb08475aa9ca24dea61ae98708\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-05T14:46:23+00:00",
      "cve": "CVE-2026-46271",
      "id": "CVE-2026-46271",
      "initial_release_date": "2026-06-03T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath12k: do WoW offloads only on primary link",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46271.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-03T23:38:54Z",
      "cve": "CVE-2026-46271",
      "id": "CVE-2026-46271",
      "initial_release_date": "2026-06-04T02:21:39Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46271",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46271.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.