Linux kernel ath12k driver vulnerabilities

In the Linux kernel, the wifi ath12k driver has a deadlock while flushing management frames. After management transmission was converted to a wiphy work, ath12k_mac_op_flush() called with a NULL vif holds the wiphy lock, preventing the queued transmission work from running. This results in failed authentication/association and a 'failed to flush mgmt transmit queue' error.

In the Linux kernel, the ath12k Wi-Fi driver accesses an uninitialized arvif->ar pointer during beacon miss handling. This occurs for P2P interfaces that have their radio object detached after scan completion, leading to a NULL pointer dereference and kernel crash (KASAN: null-ptr-deref).

In the Linux kernel, the wifi ath12k driver has a memory leak when enabling extended statistics mode. The driver allocates a mon_mpdu object while handling the HAL_RX_MPDU_START TLV but does not free it when only extended statistics mode is active (without standalone monitor mode).