CVE-2026-23133

A flaw was found in the Linux kernel's ath10k Wi-Fi driver. This memory management bug occurs during the copy engine ring teardown process, where the driver incorrectly frees Direct Memory Access (DMA) coherent buffers. A local attacker with low privileges could exploit this by triggering the flawed teardown, potentially leading to memory leaks, resource exhaustion, and system instability, resulting in a Denial of Service (DoS).

A memory management bug exists in the ath10k copy engine ring teardown path. The driver allocates DMA coherent descriptor rings with dma_alloc_coherent and stores the original addresses in unaligned fields. It also derives aligned addresses for device consumption. The buggy code passed the aligned CPU pointer and aligned DMA address into dma_free_coherent. The DMA API requires that dma_free_coherent is called with the exact CPU virtual address and DMA handle that were returned by dma_alloc_coherent. Freeing with adjusted aligned addresses can cause incorrect freeing behavior. This may manifest as DMA API warnings. It may also lead to memory leaks and resource exhaustion. Under some configurations it could contribute to instability during device reset or module unload.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.