CVE-2023-52769

What it actually does

Missing RCU read-side critical section around ath12k_mac_get_ar_by_pdev_id() call in htt mlo-offset event handler allows use-after-free on active pdev objects protected by RCU.

Why it matters to the business

Local attackers on systems using ath12k Wi-Fi hardware can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation; widespread kernel updates required across Linux distributions.

How an attack unfolds

An attacker with local access crafts or triggers MLO-related htt events while the driver is handling pdev state changes; absence of RCU read lock permits the pdev object to be freed during the lookup, resulting in use-after-free dereference.

How to fix it

Apply the kernel patch that adds the RCU read-side critical section (commit d908ca431e20b0e4bfc5d911d1744910ed779bdb) or upgrade to a stable kernel release containing this fix; recompile and reboot affected systems.

How to confirm the fix worked

Confirm the fix by inspecting the htt mlo-offset event handler for rcu_read_lock()/rcu_read_unlock() around the ath12k_mac_get_ar_by_pdev_id() call; verify the commit is present in the running kernel source tree.

Typical attack path

1. Obtain local user access on a system with ath12k hardware and the vulnerable driver
2. Trigger or manipulate Wi-Fi MLO/htt events that invoke ath12k_mac_get_ar_by_pdev_id() outside an RCU read section
3. Race with pdev teardown to cause use-after-free
4. Leverage resulting memory corruption for crash or code execution

How to detect it

Review kernel logs for ath12k-related oops or use-after-free warnings during Wi-Fi event handling; examine dmesg and /var/log/kern.log for RCU or pdev dereference faults around MLO events.

What your security team should do

• Prioritize kernel upgrades on all systems exposing ath12k Wi-Fi
• Monitor vendor advisories for backported fixes in distribution kernels
• Test the updated kernel in staging environments before broad deployment
• Restrict local access where possible until patches are applied