CVE-2024-53188 (GCVE-0-2024-53188)

Vulnerability from cvelistv5 – Published: 2024-12-27 13:49 – Updated: 2026-08-05 11:44
VLAI
Title
wifi: ath12k: fix crash when unbinding
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix crash when unbinding If there is an error during some initialization related to firmware, the function ath12k_dp_cc_cleanup is called to release resources. However this is released again when the device is unbinded (ath12k_pci), and we get: BUG: kernel NULL pointer dereference, address: 0000000000000020 at RIP: 0010:ath12k_dp_cc_cleanup.part.0+0xb6/0x500 [ath12k] Call Trace: ath12k_dp_cc_cleanup ath12k_dp_free ath12k_core_deinit ath12k_pci_remove ... The issue is always reproducible from a VM because the MSI addressing initialization is failing. In order to fix the issue, just set to NULL the released structure in ath12k_dp_cc_cleanup at the end.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 81da9c0854545c3188ca2a09afe7cb65f9c012b5 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 2eec88c0fa63f8ad35704a8c9df0b5bd8694fcda (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 488d2959c28621e52b3cce118a813a4bc18bb3d1 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 1304446f67863385dc4c914b6e0194f6664ee764 (git)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.64 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53188",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:04:13.907854Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:21.292Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81da9c0854545c3188ca2a09afe7cb65f9c012b5",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "2eec88c0fa63f8ad35704a8c9df0b5bd8694fcda",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "488d2959c28621e52b3cce118a813a4bc18bb3d1",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "1304446f67863385dc4c914b6e0194f6664ee764",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix crash when unbinding\n\nIf there is an error during some initialization related to firmware,\nthe function ath12k_dp_cc_cleanup is called to release resources.\nHowever this is released again when the device is unbinded (ath12k_pci),\nand we get:\nBUG: kernel NULL pointer dereference, address: 0000000000000020\nat RIP: 0010:ath12k_dp_cc_cleanup.part.0+0xb6/0x500 [ath12k]\nCall Trace:\nath12k_dp_cc_cleanup\nath12k_dp_free\nath12k_core_deinit\nath12k_pci_remove\n...\n\nThe issue is always reproducible from a VM because the MSI addressing\ninitialization is failing.\n\nIn order to fix the issue, just set to NULL the released structure in\nath12k_dp_cc_cleanup at the end."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is reached through local driver teardown \u2014 `ath12k_pci_remove()` via a sysfs unbind or `delete_module()` \u2014 or through the driver\u0027s local firmware-recovery worker; no remote or adjacent 802.11 frame drives the vulnerable path directly.\nAC:L - There is no race and no memory-layout dependency; once a firmware/DP init error has occurred the stale `dp-\u003espt_info` is deterministic, and the reporter notes it is \"always reproducible from a VM\" where MSI addressing initialization reliably fails.\nPR:L - The `ath12k_core_reconfigure_on_crash()` path reaches the second `ath12k_dp_cc_cleanup()` with no privilege at all after two failed recovery cycles, and the CNA scored the directly analogous ath12k error-path dangling-pointer bug (CVE-2025-38116) at PR:L rather than PR:H.\nUI:N - The triggering action is the attacker\u0027s own unbind/module-removal or the driver\u0027s automatic recovery worker; no separate victim needs to be induced to do anything.\nS:U - The freed memory, the stale pointer, and the fault are all within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The root cause is a retained pointer to freed kmalloc\u0027d memory whose contents are re-read on the second cleanup (`dp-\u003espt_info[i].vaddr/paddr`); an attacker who reclaims that slab allocation controls the values read, giving a heap-content disclosure primitive.\nI:H - Operating on the freed `spt_info` array feeds attacker-groomable heap contents into `dma_free_coherent()`, yielding a double-free of DMA coherent mappings \u2014 memory corruption leverageable beyond a simple crash.\nA:H - The immediate result is a kernel oops (NULL dereference at offset 0x20) taken while `dp-\u003erx_desc_lock` is held with BH disabled, so the spinlock is never released and any later taker deadlocks \u2014 a hard denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:30.535Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81da9c0854545c3188ca2a09afe7cb65f9c012b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2eec88c0fa63f8ad35704a8c9df0b5bd8694fcda"
        },
        {
          "url": "https://git.kernel.org/stable/c/488d2959c28621e52b3cce118a813a4bc18bb3d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/1304446f67863385dc4c914b6e0194f6664ee764"
        }
      ],
      "title": "wifi: ath12k: fix crash when unbinding",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53188",
    "datePublished": "2024-12-27T13:49:31.170Z",
    "dateReserved": "2024-11-19T17:17:25.012Z",
    "dateUpdated": "2026-08-05T11:44:30.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53188",
      "date": "2026-08-08",
      "epss": "0.00245",
      "percentile": "0.15774"
    },
    "microsoft_vex": {
      "current_release_date": "2025-01-29T00:00:00.000Z",
      "cve": "CVE-2024-53188",
      "id": "msrc_CVE-2024-53188",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: ath12k: fix crash when unbinding",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-53188.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53188\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T14:15:26.297\",\"lastModified\":\"2026-06-17T08:08:32.433\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: fix crash when unbinding\\n\\nIf there is an error during some initialization related to firmware,\\nthe function ath12k_dp_cc_cleanup is called to release resources.\\nHowever this is released again when the device is unbinded (ath12k_pci),\\nand we get:\\nBUG: kernel NULL pointer dereference, address: 0000000000000020\\nat RIP: 0010:ath12k_dp_cc_cleanup.part.0+0xb6/0x500 [ath12k]\\nCall Trace:\\nath12k_dp_cc_cleanup\\nath12k_dp_free\\nath12k_core_deinit\\nath12k_pci_remove\\n...\\n\\nThe issue is always reproducible from a VM because the MSI addressing\\ninitialization is failing.\\n\\nIn order to fix the issue, just set to NULL the released structure in\\nath12k_dp_cc_cleanup at the end.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: se corrige el fallo al desvincular Si hay un error durante alguna inicializaci\u00f3n relacionada con el firmware, se llama a la funci\u00f3n ath12k_dp_cc_cleanup para liberar recursos. Sin embargo, esto se libera de nuevo cuando se desvincula el dispositivo (ath12k_pci), y obtenemos: ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000020 en RIP: 0010:ath12k_dp_cc_cleanup.part.0+0xb6/0x500 [ath12k] Seguimiento de llamadas: ath12k_dp_cc_cleanup ath12k_dp_free ath12k_core_deinit ath12k_pci_remove ... El problema siempre se puede reproducir desde una m\u00e1quina virtual porque la inicializaci\u00f3n del direccionamiento MSI est\u00e1 fallando. Para solucionar el problema, simplemente establezca en NULL la estructura liberada en ath12k_dp_cc_cleanup al final.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/dp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"81da9c0854545c3188ca2a09afe7cb65f9c012b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"2eec88c0fa63f8ad35704a8c9df0b5bd8694fcda\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"488d2959c28621e52b3cce118a813a4bc18bb3d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"1304446f67863385dc4c914b6e0194f6664ee764\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/dp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.64\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:04:13.907854Z\",\"id\":\"CVE-2024-53188\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.64\",\"matchCriteriaId\":\"EC9D57B7-484D-412B-9962-8850DC0C6F66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"21434379-192D-472F-9B54-D45E3650E893\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1304446f67863385dc4c914b6e0194f6664ee764\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2eec88c0fa63f8ad35704a8c9df0b5bd8694fcda\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/488d2959c28621e52b3cce118a813a4bc18bb3d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81da9c0854545c3188ca2a09afe7cb65f9c012b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:08:26+00:00",
      "cve": "CVE-2024-53188",
      "id": "CVE-2024-53188",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath12k: fix crash when unbinding",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53188.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53188\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:04:13.907854Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:37:18.505Z\"}}], \"cna\": {\"title\": \"wifi: ath12k: fix crash when unbinding\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The defect is reached through local driver teardown \\u2014 `ath12k_pci_remove()` via a sysfs unbind or `delete_module()` \\u2014 or through the driver\u0027s local firmware-recovery worker; no remote or adjacent 802.11 frame drives the vulnerable path directly.\\nAC:L - There is no race and no memory-layout dependency; once a firmware/DP init error has occurred the stale `dp-\u003espt_info` is deterministic, and the reporter notes it is \\\"always reproducible from a VM\\\" where MSI addressing initialization reliably fails.\\nPR:L - The `ath12k_core_reconfigure_on_crash()` path reaches the second `ath12k_dp_cc_cleanup()` with no privilege at all after two failed recovery cycles, and the CNA scored the directly analogous ath12k error-path dangling-pointer bug (CVE-2025-38116) at PR:L rather than PR:H.\\nUI:N - The triggering action is the attacker\u0027s own unbind/module-removal or the driver\u0027s automatic recovery worker; no separate victim needs to be induced to do anything.\\nS:U - The freed memory, the stale pointer, and the fault are all within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The root cause is a retained pointer to freed kmalloc\u0027d memory whose contents are re-read on the second cleanup (`dp-\u003espt_info[i].vaddr/paddr`); an attacker who reclaims that slab allocation controls the values read, giving a heap-content disclosure primitive.\\nI:H - Operating on the freed `spt_info` array feeds attacker-groomable heap contents into `dma_free_coherent()`, yielding a double-free of DMA coherent mappings \\u2014 memory corruption leverageable beyond a simple crash.\\nA:H - The immediate result is a kernel oops (NULL dereference at offset 0x20) taken while `dp-\u003erx_desc_lock` is held with BH disabled, so the spinlock is never released and any later taker deadlocks \\u2014 a hard denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"81da9c0854545c3188ca2a09afe7cb65f9c012b5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"2eec88c0fa63f8ad35704a8c9df0b5bd8694fcda\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"488d2959c28621e52b3cce118a813a4bc18bb3d1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"1304446f67863385dc4c914b6e0194f6664ee764\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/dp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/dp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/81da9c0854545c3188ca2a09afe7cb65f9c012b5\"}, {\"url\": \"https://git.kernel.org/stable/c/2eec88c0fa63f8ad35704a8c9df0b5bd8694fcda\"}, {\"url\": \"https://git.kernel.org/stable/c/488d2959c28621e52b3cce118a813a4bc18bb3d1\"}, {\"url\": \"https://git.kernel.org/stable/c/1304446f67863385dc4c914b6e0194f6664ee764\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: fix crash when unbinding\\n\\nIf there is an error during some initialization related to firmware,\\nthe function ath12k_dp_cc_cleanup is called to release resources.\\nHowever this is released again when the device is unbinded (ath12k_pci),\\nand we get:\\nBUG: kernel NULL pointer dereference, address: 0000000000000020\\nat RIP: 0010:ath12k_dp_cc_cleanup.part.0+0xb6/0x500 [ath12k]\\nCall Trace:\\nath12k_dp_cc_cleanup\\nath12k_dp_free\\nath12k_core_deinit\\nath12k_pci_remove\\n...\\n\\nThe issue is always reproducible from a VM because the MSI addressing\\ninitialization is failing.\\n\\nIn order to fix the issue, just set to NULL the released structure in\\nath12k_dp_cc_cleanup at the end.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.64\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.11\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.2\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:44:30.535Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53188\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:44:30.535Z\", \"dateReserved\": \"2024-11-19T17:17:25.012Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T13:49:31.170Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.