Riskcovery

CVE-2024-49930

wifi: ath11k: fix array out-of-bound access in SoC stats

State
Published
Severity
8.8 High
Published
Oct 21, 2024
Updated
Oct 15, 2026
Reserved
Oct 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix array out-of-bound access in SoC stats

Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access.

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d5c65159f2895379e11ca13f62feabe93278985d to before 0f26f26944035ec67546a944f182cbad6577a9c0Affected
  • d5c65159f2895379e11ca13f62feabe93278985d to before 4dd732893bd38cec51f887244314e2b47f0d658fAffected
  • d5c65159f2895379e11ca13f62feabe93278985d to before 73e235728e515faccc104b0153b47d0f263b3344Affected
  • d5c65159f2895379e11ca13f62feabe93278985d to before 7a552bc2f3efe2aaf77a85cb34cdf4a63d81a1a7Affected
  • d5c65159f2895379e11ca13f62feabe93278985d to before 6045ef5b4b00fee3629689f791992900a1c94009Affected
  • d5c65159f2895379e11ca13f62feabe93278985d to before 01b77f5ee11c89754fb836af8f76799d3b72ae2fAffected
  • d5c65159f2895379e11ca13f62feabe93278985d to before 69f253e46af98af17e3efa3e5dfa72fcb7d1983dAffected
LinuxLinux
  • 5.6Affected
  • before 5.6Not affected
  • 5.10.227 through 5.10.*Not affected
  • 5.15.168 through 5.15.*Not affected
  • 6.1.113 through 6.1.*Not affected
  • 6.6.55 through 6.6.*Not affected
  • 6.10.14 through 6.10.*Not affected
  • 6.11.3 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.