CVE-2023-52829

What it actually does

Unvalidated reg_cap.phy_id extracted from a WMI event allows an out-of-bounds write into soc->hal_reg_cap inside ath12k_wmi_ext_hal_reg_caps().

Why it matters to the business

Memory corruption in the Linux kernel wireless driver can produce crashes, instability, or local privilege escalation on systems using affected ath12k hardware, raising support costs and availability risk.

How an attack unfolds

An attacker or malicious firmware supplies a WMI event containing an out-of-range phy_id value; the driver writes beyond the intended array bounds without checking, corrupting kernel memory structures.

How to fix it

Upgrade the Linux kernel to the commit dfe13eaab043130f90dd3d57c7d88577c04adc97 or any later stable release that contains the phy_id bounds check.

How to confirm the fix worked

Inspect the ath12k_wmi_ext_hal_reg_caps function for an explicit bounds check on reg_cap.phy_id before indexing into soc->hal_reg_cap; confirm the patch is present in the running kernel source or binary.

Typical attack path

1. Obtain ability to inject or influence a WMI event (local user, compromised firmware, or adjacent device)
2. Supply reg_cap.phy_id larger than the allocated hal_reg_cap array
3. Trigger ath12k_wmi_ext_hal_reg_caps processing
4. Perform out-of-bounds write to corrupt adjacent kernel data
5. Escalate privileges or cause denial of service

How to detect it

Review kernel logs for ath12k driver oops or panic messages referencing hal_reg_cap or WMI event handling; examine recent changes to wireless firmware or driver loading.

What your security team should do

• Apply the referenced kernel commit or newer distribution packages immediately on all systems exposing ath12k wireless hardware
• Prioritize updates for internet-facing or multi-user hosts
• Monitor vendor advisories for backported fixes in supported LTS kernels