CVE-2024-43881

What it actually does

Incorrect DMA mapping direction (DMA_FROM_DEVICE instead of DMA_TO_DEVICE) for reinjected reassembled Wi-Fi fragments in the ath12k driver allows arbitrary kernel memory contents allocated to skb buffers to be transmitted, enabling information disclosure.

Why it matters to the business

Organizations running affected Linux kernels on Wi-Fi hardware using the ath12k driver face risk of sensitive kernel memory contents being leaked over the network, which could expose credentials, keys, or other private data and trigger compliance or incident response costs; urgency is low given absence from KEV and stable low EPSS.

How an attack unfolds

An attacker sends fragmented 802.11 frames that the ath12k driver reassembles into an skb; the driver then maps the buffer with the wrong DMA direction and reinjects it into the hardware ring, causing the hardware to transmit whatever kernel memory was allocated to that skb instead of the intended payload.

How to fix it

Upgrade the Linux kernel to a version containing commit e99d9b16ff153de9540073239d24adc3b0a3a997 or later; rebuild and deploy the updated kernel on all affected systems using ath12k Wi-Fi hardware.

How to confirm the fix worked

Confirm the running kernel contains commit e99d9b16ff153de9540073239d24adc3b0a3a997 via git log or kernel version string; test that fragmented packet reinjection no longer maps DMA_FROM_DEVICE and that no unintended memory is transmitted.

Typical attack path

1. Attacker transmits 802.11 fragmented frames targeting the vulnerable ath12k device
2. Driver reassembles fragments into an skb buffer backed by arbitrary kernel memory
3. Driver incorrectly sets DMA direction to FROM_DEVICE and reinjects the buffer
4. Hardware transmits the unintended kernel memory contents to the network or host
5. Attacker observes or captures the leaked data

How to detect it

Examine kernel logs for ath12k DMA mapping warnings or errors around packet reinjection; inspect network traffic for unexpected payloads originating from the ath12k interface; review system memory allocation patterns for skb buffers during high fragmentation scenarios.

What your security team should do

• Prioritize kernel upgrade on all systems using QCN9274 or other ath12k hardware within standard patch windows
• Monitor vendor kernel updates and backports for the referenced commit
• Review Wi-Fi driver configurations and limit exposure of systems handling sensitive data over wireless
• Include the fix in next maintenance cycle given low EPSS and no KEV listing