CVE-2024-58096

wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode

State
Published
Severity
8.8 High
Published
Apr 16, 2025
Updated
Oct 30, 2026
Reserved
Mar 6, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode

ath11k_hal_srng_* should be used with srng->lock to protect srng data.

For ath11k_dp_rx_mon_dest_process() and ath11k_dp_full_mon_process_rx(), they use ath11k_hal_srng_* for many times but never call srng->lock.

So when running (full) monitor mode, warning will occur: RIP: 0010:ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k] Call Trace: ? ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k] ath11k_dp_rx_process_mon_status+0xc45/0x1190 [ath11k] ? idr_alloc_u32+0x97/0xd0 ath11k_dp_rx_process_mon_rings+0x32a/0x550 [ath11k] ath11k_dp_service_srng+0x289/0x5a0 [ath11k] ath11k_pcic_ext_grp_napi_poll+0x30/0xd0 [ath11k] __napi_poll+0x30/0x1f0 net_rx_action+0x198/0x320 __do_softirq+0xdd/0x319

So add srng->lock for them to avoid such warnings.

Inorder to fetch the srng->lock, should change srng's definition from 'void' to 'struct hal_srng'. And initialize them elsewhere to prevent one line of code from being too long. This is consistent with other ring process functions, such as ath11k_dp_process_rx().

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d5c65159f2895379e11ca13f62feabe93278985d to before b7cc16629ae391c8ba44464ca29fcbbc1a3e1336Affected
  • d5c65159f2895379e11ca13f62feabe93278985d to before 27ca8004ba93a0665faa6d477eaeb551e03de6c8Affected
  • d5c65159f2895379e11ca13f62feabe93278985d to before 1d2178918efc928e11bed9631469ef79ff0a862aAffected
  • d5c65159f2895379e11ca13f62feabe93278985d to before b85758e76b6452740fc2a08ced6759af64c0d59aAffected
  • d5c65159f2895379e11ca13f62feabe93278985d to before 63b7af49496d0e32f7a748b6af3361ec138b1bd3Affected
LinuxLinux
  • 5.6Affected
  • before 5.6Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.123 through 6.6.*Not affected
  • 6.12.69 through 6.12.*Not affected
  • 6.14.2 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.