{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53191", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:25.013Z", "datePublished": "2024-12-27T13:49:33.617Z", "dateUpdated": "2026-08-05T11:44:31.599Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:31.599Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix warning when unbinding\n\nIf there is an error during some initialization related to firmware,\nthe buffers dp->tx_ring[i].tx_status are released.\nHowever this is released again when the device is unbinded (ath12k_pci),\nand we get:\nWARNING: CPU: 0 PID: 2098 at mm/slub.c:4689 free_large_kmalloc+0x4d/0x80\nCall Trace:\nfree_large_kmalloc\nath12k_dp_free\nath12k_core_deinit\nath12k_pci_remove\n...\n\nThe issue is always reproducible from a VM because the MSI addressing\ninitialization is failing.\n\nIn order to fix the issue, just set the buffers to NULL after releasing in\norder to avoid the double free." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The second free is reached through local system events — PCI driver unbind via sysfs, `rmmod`, or an automatic firmware-crash recovery cycle — not through any received WiFi frame or network packet. No over-the-air input path reaches `ath12k_dp_free()`.\nAC:L - The commit states the triggering initialization failure is \"always reproducible from a VM because the MSI addressing initialization is failing,\" so the dangling pointer is created deterministically on every probe in that environment, and the attacker only has to drive one more teardown to complete the double free.\nPR:L - The dangling pointer is created automatically at probe with no privileges at all, and the `ath12k_core_restart` → `ath12k_core_reconfigure_on_crash` → `ath12k_dp_free` recovery path reaches the second free without any elevated capability; only the sysfs-unbind variant would need root, so the lower-privilege reachable path governs.\nUI:N - No victim action is required — the firmware init failure and the freeing happen automatically inside the QMI event worker and the restart work item, and the completing teardown is either the attacker's own action or an automatic recovery cycle.\nS:U - The corruption is confined to kernel page/slab allocator state within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `free_large_kmalloc()` warns but still executes `folio_put()`, dropping a refcount on multi-megabyte folios that may already have been reallocated, so the same physical pages end up owned by two subsystems and the stale ath12k mapping can be used to read page-cache, slab, or page-table contents belonging to other users.\nI:H - Releasing a live folio's reference lets pages in active use be freed and re-handed out, and if the region has been re-used as a slab the second `kfree()` runs `slab_free()` on a bogus object and corrupts the SLUB freelist — both are write/control-flow-hijack-capable primitives obtainable with heap grooming.\nA:H - Even unexploited, the double free produces a kernel WARNING plus page-refcount and `NR_SLAB_UNRECLAIMABLE_B` accounting corruption that reliably escalates to slab/page corruption and a kernel oops or panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/dp.c" ], "versions": [ { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "223b546c6222d42147eff034433002ca5e2e7e09", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "90556b96338aa6037cd26dac857327fda7c19732", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "94c9100b600f05a36b33f9ed76dbd6fb0eb25386", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "ca68ce0d9f4bcd032fd1334441175ae399642a06", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/dp.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/223b546c6222d42147eff034433002ca5e2e7e09" }, { "url": "https://git.kernel.org/stable/c/90556b96338aa6037cd26dac857327fda7c19732" }, { "url": "https://git.kernel.org/stable/c/94c9100b600f05a36b33f9ed76dbd6fb0eb25386" }, { "url": "https://git.kernel.org/stable/c/ca68ce0d9f4bcd032fd1334441175ae399642a06" } ], "title": "wifi: ath12k: fix warning when unbinding", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53191", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:04:07.391324Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:20.969Z" } } ] } }