CVE-2026-46271: wifi: ath12k: do WoW offloads only on primary link

Synopsis

This is a firmware crash vulnerability in the Linux kernel's ath12k Wi-Fi driver, affecting the WCN7850 chipset during Wake-on-Wireless (WoW) offload handling in multi-link connections. An attacker with a local shell and low-privilege access can trigger the flaw without any network exposure or victim interaction. Successful exploitation crashes the affected wireless firmware, disrupting wireless connectivity. Patched-image rebuilds at versions 6.18.14, 6.19.4, and 7.0 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerability; no elevated or administrator credentials are needed.

• Victim interactionNot required

  Exploitation requires no action from another user or process; the attacker acts entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or environmental dependencies required to trigger the firmware crash.

Blast Radius

• Crashes the WCN7850 wireless firmware, taking down the affected wireless interface and severing any active Wi-Fi connections on the host.
• Reads of sensitive kernel memory associated with the wireless subsystem may be possible given the high confidentiality impact rating in the CVSS score.
• Modifies kernel or firmware state associated with the ath12k driver, potentially corrupting Wi-Fi link configuration data.
• Causes a denial-of-service condition for all processes on the host that depend on wireless connectivity through the affected interface.