CVE-2024-57995

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()

In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different radio, it gets deleted from that radio through a call to ath12k_mac_unassign_link_vif(). This action frees the arvif pointer. Subsequently, there is a check involving arvif, which will result in a read-after-free scenario.

Fix this by moving this check after arvif is again assigned via call to ath12k_mac_assign_link_vif().

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1

This vulnerability is rated as having a Moderate impact because exploitation requires local privileged access and relies on the presence of Qualcomm Wi-Fi 7 (ath12k) hardware, which is rarely utilized in enterprise server environments. The issue occurs during wireless interface reconfiguration across radios, limiting the blast radius to a local denial of service or potential kernel memory corruption on systems running specific wireless configurations. Systems without this specialized wireless adapter or without the ath12k driver active are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.