---
id: CVE-2026-74368
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()

  In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to
  ath12k_dp_rx_check_nwifi_hdr_len_valid()…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()

  In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to
  ath12k_dp_rx_check_nwifi_hdr_len_valid()…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9a0dddfb30f120db3851627935851d262e4e7acb <
    55c6f05b667726d2da5fd011d646fb48ce5b6b9c
  - >-
    Linux >= 9a0dddfb30f120db3851627935851d262e4e7acb <
    5187a92099778501f21af76ed6c8415d128e7298
  - >-
    Linux >= 9a0dddfb30f120db3851627935851d262e4e7acb <
    98d4f92ab6a1af2ea2ab590d7e2801b203110981
  - Linux 7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c
  - Linux 3abe15e756481c45f6acba3d476cb3ca4afc3b61
  - Linux 6ee653194ddb83674913fd2727b8ecfae0597ade
  - Linux 50be1fb76556e80af9f5da80f28168b6c71bce58
  - Linux >= 6.6.88 < 6.7
  - Linux >= 6.12.24 < 6.13
  - Linux >= 6.13.12 < 6.14
  - Linux >= 6.14.3 < 6.15
  - Linux 6.15
published: '2026-08-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:45.787'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74368'
references:
  - url: 'https://git.kernel.org/stable/c/5187a92099778501f21af76ed6c8415d128e7298'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/55c6f05b667726d2da5fd011d646fb48ce5b6b9c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00198
epssPercentile: 0.08907
ingestedAt: '2026-10-15T11:00:41.676Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()

In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to
ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the
NWIFI header length is invalid, causing the function to abort early with
-EINVAL.

When this happens, the error propagates to
ath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it
to NULL. As a result, the corresponding MSDU is no longer referenced
by the defragmentation path and is never freed.

This leads to a memory leak for the affected MSDU on this error path.
Proper cleanup is required to ensure the MSDU is released when header
validation fails during TKIP MIC verification.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.