CVE-2019-15099

What it actually does

NULL pointer dereference in the ath10k USB wireless driver when processing an endpoint descriptor containing an incomplete address, causing a kernel crash and loss of availability.

Why it matters to the business

Systems relying on affected USB wireless hardware can suffer sudden crashes or reboots when exposed to malformed device descriptors, leading to unplanned downtime and potential data loss for connected users.

How an attack unfolds

An attacker supplies a USB device or emulated endpoint descriptor with an incomplete address; the driver dereferences a NULL pointer during initialization, triggering a kernel panic without requiring authentication or user interaction.

How to fix it

Upgrade the Linux kernel to a version containing the fix (commit 9f791535cde1539338f6ba1b9154006595d97fe7 or later equivalent backports) and reboot affected systems. Disable the ath10k USB driver if the hardware is not required.

How to confirm the fix worked

Confirm the running kernel version is newer than 5.2.8 and contains the referenced commit; test by connecting a device that previously triggered the crash and verify no NULL dereference occurs in dmesg.

Typical attack path

1. Attacker connects a malicious or emulated USB wireless device
2. Kernel USB subsystem enumerates the device and passes the endpoint descriptor
3. ath10k driver processes the incomplete address field
4. NULL pointer dereference occurs resulting in immediate system crash

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference messages referencing ath10k/usb.c around the time of USB device insertion; correlate with unexpected reboots on systems using ath10k USB hardware.

What your security team should do

• Prioritize patching systems with ath10k USB wireless hardware within standard change windows
• Monitor vendor advisories for backported fixes in distribution kernels
• Consider disabling the driver via modprobe blacklist where USB wireless is unnecessary