CVE-2024-49930

wifi: ath11k: fix array out-of-bound access in SoC stats

HIGH
7.8
CVSS Score
Published: October 21, 2024 at 06:01 PM UTC
Updated: October 15, 2026 at 01:19 AM UTC
2 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 TM MFP

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix array out-of-bound access in SoC stats Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 5.10.2275.11 ≤ v < 5.15.1685.16 ≤ v < 6.1.1136.11 ≤ v < 6.11.36.2 ≤ v < 6.6.556.7 ≤ v < 6.10.145.6d5c65159f2895379e11ca13f62feabe93278985d
Vendor states this is fixed in 01b77f5ee11c89754fb836af8f76799d3b72ae2f (fixed)
Vendor states this is fixed in 0f26f26944035ec67546a944f182cbad6577a9c0 (fixed)
Vendor states this is fixed in 4dd732893bd38cec51f887244314e2b47f0d658f (fixed)
Vendor states this is fixed in 6045ef5b4b00fee3629689f791992900a1c94009 (fixed)
Vendor states this is fixed in 69f253e46af98af17e3efa3e5dfa72fcb7d1983d (fixed)
Vendor states this is fixed in 73e235728e515faccc104b0153b47d0f263b3344 (fixed)
Vendor states this is fixed in 7a552bc2f3efe2aaf77a85cb34cdf4a63d81a1a7 (fixed)
Vendor states this is fixed in 5.10.227 (unaffected)
Vendor states this is fixed in 5.15.168 (unaffected)
Vendor states this is fixed in 5.6 (unaffected)
Vendor states this is fixed in 6.1.113 (unaffected)
Vendor states this is fixed in 6.10.14 (unaffected)
Vendor states this is fixed in 6.11.3 (unaffected)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.6.55 (unaffected)

References (11)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/01b77f5ee11c89754fb836af8f76799d3b72ae2f
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0f26f26944035ec67546a944f182cbad6577a9c0
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4dd732893bd38cec51f887244314e2b47f0d658f
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6045ef5b4b00fee3629689f791992900a1c94009
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/69f253e46af98af17e3efa3e5dfa72fcb7d1983d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/73e235728e515faccc104b0153b47d0f263b3344
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7a552bc2f3efe2aaf77a85cb34cdf4a63d81a1a7
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-129

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card