Cloudanix VulnDB

CVE-2023-53764

None

CVSS

—

EPSS

0.2%

Published

Dec 8, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Linux kernel's handling of wireless network errors on certain WiFi chips could cause system warnings or instability until the operating system is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The ath12k_peer_find_by_id() function is invoked without holding ab->base_lock in the WBM error path of ath12k_dp_rx_process_wbm_err, violating the expected lock requirement and triggering lockdep assertions during concurrent peer operations.

Why it matters to the business

Affected Linux systems with ath12k WiFi hardware may experience kernel warnings or instability during wireless error handling, reducing network reliability on Ubuntu deployments until patched.

How an attack unfolds

An attacker sends wireless frames that force the driver into the WBM error path while peer lookups occur, exposing the unprotected call to ath12k_peer_find_by_id and producing lock violations.

How to fix it

Upgrade the linux package on Ubuntu 20.04 LTS to version 5.4.0-88.99 or later to include the spin lock/unlock handling fix in the WBM error path.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the fixed release and verify absence of ath12k_peer_find_by_id lockdep warnings in dmesg after wireless activity.

Typical attack path

  1. Send crafted 802.11 frames to trigger WBM error processing
  2. Enter ath12k_dp_rx_process_wbm_err without acquiring ab->base_lock
  3. Invoke ath12k_peer_find_by_id() causing lockdep assertion failure

How to detect it

Search kernel logs (dmesg, syslog) for messages referencing ath12k_peer_find_by_id, lockdep warnings, and the WBM error path during wireless receive processing.

  • ath12k_peer_find_by_id+0x52/0x60
  • ath12k_dp_rx_process_wbm_err
  • WARNING: CPU:.*at drivers/net/wireless/ath/ath12k/peer.c:71

What your security team should do

  • Apply the kernel update to 5.4.0-88.99 on all Ubuntu 20.04 systems using ath12k hardware
  • Reboot affected hosts and monitor for recurrence of the lock warning
  • Prioritize updates on systems with QCN9274 WiFi where the assertion was observed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Handle lock during peer_id find ath12k_peer_find_by_id() requires that the caller hold the ab->base_lock. Currently the WBM error path does not hold the lock and calling that function, leads to the following lockdep_assert()in QCN9274: [105162.160893] ------------[ cut here ]------------ [105162.160916] WARNING: CPU: 3 PID: 0 at drivers/net/wireless/ath/ath12k/peer.c:71 ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160933] Modules linked in: ath12k(O) qrtr_mhi qrtr mac80211 cfg80211 mhi qmi_helpers libarc4 nvme nvme_core [last unloaded: ath12k(O)] [105162.160967] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G W O 6.1.0-rc2+ #3 [105162.160972] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0056.2019.0506.1527 05/06/2019 [105162.160977] RIP: 0010:ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160990] Code: 07 eb 0f 39 68 24 74 0a 48 8b 00 48 39 f8 75 f3 31 c0 5b 5d c3 48 8d bf b0 f2 00 00 be ff ff ff ff e8 22 20 c4 e2 85 c0 75 bf <0f> 0b eb bb 66 2e 0f 1f 84 00 00 00 00 00 41 54 4c 8d a7 98 f2 00 [105162.160996] RSP: 0018:ffffa223001acc60 EFLAGS: 00010246 [105162.161003] RAX: 0000000000000000 RBX: ffff9f0573940000 RCX: 0000000000000000 [105162.161008] RDX: 0000000000000001 RSI: ffffffffa3951c8e RDI: ffffffffa39a96d7 [105162.161013] RBP: 000000000000000a R08: 0000000000000000 R09: 0000000000000000 [105162.161017] R10: ffffa223001acb40 R11: ffffffffa3d57c60 R12: ffff9f057394f2e0 [105162.161022] R13: ffff9f0573940000 R14: ffff9f04ecd659c0 R15: ffff9f04d5a9b040 [105162.161026] FS: 0000000000000000(0000) GS:ffff9f0575600000(0000) knlGS:0000000000000000 [105162.161031] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105162.161036] CR2: 00001d5c8277a008 CR3: 00000001e6224006 CR4: 00000000003706e0 [105162.161041] Call Trace: [105162.161046] <IRQ> [105162.161051] ath12k_dp_rx_process_wbm_err+0x6da/0xaf0 [ath12k] [105162.161072] ? ath12k_dp_rx_process_err+0x80e/0x15a0 [ath12k] [105162.161084] ? __lock_acquire+0x4ca/0x1a60 [105162.161104] ath12k_dp_service_srng+0x263/0x310 [ath12k] [105162.161120] ath12k_pci_ext_grp_napi_poll+0x1c/0x70 [ath12k] [105162.161133] __napi_poll+0x22/0x260 [105162.161141] net_rx_action+0x2f8/0x380 [105162.161153] __do_softirq+0xd0/0x4c9 [105162.161162] irq_exit_rcu+0x88/0xe0 [105162.161169] common_interrupt+0xa5/0xc0 [105162.161174] </IRQ> [105162.161179] <TASK> [105162.161184] asm_common_interrupt+0x22/0x40 Handle spin lock/unlock in WBM error path to hold the necessary lock expected by ath12k_peer_find_by_id(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-03171-QCAHKSWPL_SILICONZ-1

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 6.3.4
Linux Kernel 6.3.0 6.3.4

Related vulnerabilities