CVE-2024-53191

wifi: ath12k: fix warning when unbinding

High · published December 27, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix warning when unbinding

If there is an error during some initialization related to firmware,

the buffers dp->tx_ring[i].tx_status are released.

However this is released again when the device is unbinded (ath12k_pci),

and we get:

WARNING: CPU: 0 PID: 2098 at mm/slub.c:4689 free_large_kmalloc+0x4d/0x80

Call Trace:

free_large_kmalloc

ath12k_dp_free

ath12k_core_deinit

ath12k_pci_remove

...

The issue is always reproducible from a VM because the MSI addressing

initialization is failing.

In order to fix the issue, just set the buffers to NULL after releasing in

order to avoid the double free.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Published
2024-12-27T13:49Z
EPSS history
Timeline
  • 27 DEC 13:49Z
    wifi: ath12k: fix warning when unbinding
    cvelistv5