CVE-2023-52798

What it actually does

Missing RCU read-side critical section in ath11k DFS radar event handling allows concurrent access to pdev structures that may be freed, resulting in use-after-free.

Why it matters to the business

Kernel crashes or potential code execution on Wi-Fi enabled Linux systems could disrupt wireless operations, require emergency patching, and expose devices to targeted attacks in high-prevalence kernel deployments.

How an attack unfolds

An attacker triggers DFS radar events on an ath11k device while pdev structures are being reconfigured; without RCU protection the handler may dereference a freed object, leading to memory corruption that can be leveraged for privilege escalation or denial of service.

How to fix it

Update the Linux kernel to the commit f882f51905517575c9f793a3dff567af90ef9a10 or later stable releases that include the RCU read-side marking fix for ath11k DFS handling.

How to confirm the fix worked

Confirm the patch is present by checking for rcu_read_lock/unlock around ath11k_mac_get_ar_by_pdev_id calls in the DFS event path and verify the kernel builds and runs without regression on affected hardware.

Typical attack path

1. Obtain local or adjacent network access to a Linux system using ath11k Wi-Fi hardware
2. Generate or spoof DFS radar detection events at high frequency
3. Trigger pdev reconfiguration or removal under RCU grace periods
4. Exploit resulting use-after-free for arbitrary read/write or crash

How to detect it

Review kernel logs for ath11k DFS radar event warnings, RCU stalls, or use-after-free crashes; inspect wireless event traces for unusual radar pattern frequency coinciding with pdev state changes.

What your security team should do

• Prioritize kernel updates on all systems using ath11k Wi-Fi within the next maintenance window
• Monitor vendor advisories for backported fixes in distribution kernels
• Limit exposure by disabling DFS features where operationally feasible until patched