CVE-2024-53191

wifi: ath12k: fix warning when unbinding

HIGH
7.8
CVSS Score
Published: December 27, 2024 at 01:49 PM UTC
Updated: August 5, 2026 at 12:05 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is unbinded (ath12k_pci), and we get: WARNING: CPU: 0 PID: 2098 at mm/slub.c:4689 free_large_kmalloc+0x4d/0x80 Call Trace: free_large_kmalloc ath12k_dp_free ath12k_core_deinit ath12k_pci_remove ... The issue is always reproducible from a VM because the MSI addressing initialization is failing. In order to fix the issue, just set the buffers to NULL after releasing in order to avoid the double free.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.12 ≤ v < 6.12.26.3 ≤ v < 6.11.116.3 ≤ v < 6.12.26.3 ≤ v < 6.136.3 ≤ v < 6.6.646.7 ≤ v < 6.11.116.3d889913205cf7ebda905b1e62c5867ed4e39f6c2
Vendor states this is fixed in 223b546c6222d42147eff034433002ca5e2e7e09 (fixed)
Vendor states this is fixed in 90556b96338aa6037cd26dac857327fda7c19732 (fixed)
Vendor states this is fixed in 94c9100b600f05a36b33f9ed76dbd6fb0eb25386 (fixed)
Vendor states this is fixed in ca68ce0d9f4bcd032fd1334441175ae399642a06 (fixed)
Vendor states this is fixed in 6.11.11 (unaffected)
Vendor states this is fixed in 6.12.2 (unaffected)
Vendor states this is fixed in 6.13 (unaffected)
Vendor states this is fixed in 6.3 (unaffected)
Vendor states this is fixed in 6.6.64 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/223b546c6222d42147eff034433002ca5e2e7e09
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/90556b96338aa6037cd26dac857327fda7c19732
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/94c9100b600f05a36b33f9ed76dbd6fb0eb25386
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ca68ce0d9f4bcd032fd1334441175ae399642a06

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-415

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card