CVE-2024-49930

What it actually does

Out-of-bounds array access in ath11k_soc_dp_stats::hal_reo_error when ath11k_dp_process_rx() indexes using an SRNG ring ID instead of the normal ring ID, enabling memory corruption.

Why it matters to the business

Local attackers on affected Linux systems using ath11k WiFi hardware can trigger crashes, denial of service, or potential privilege escalation, disrupting wireless-dependent operations.

How an attack unfolds

An attacker with local access crafts input that reaches ath11k_dp_process_rx() with an out-of-range SRNG ring ID, causing the kernel to read or write beyond the hal_reo_error array bounds and corrupt adjacent memory structures.

How to fix it

Update the Linux kernel to a version containing the fix for ath11k_dp_process_rx() that uses the normal ring ID; apply vendor backports or distribution kernels that resolve the array indexing error.

How to confirm the fix worked

Confirm the patched ath11k code path is present by inspecting the source for direct use of the normal ring ID in ath11k_dp_process_rx(); test with WiFi traffic that exercises REO rings and monitor for kernel oops or memory errors.

Typical attack path

1. Obtain local shell on target Linux system with ath11k hardware
2. Trigger WiFi receive path processing that invokes ath11k_dp_process_rx()
3. Supply or influence ring ID value to exceed DP_REO_DST_RING_MAX
4. Trigger out-of-bounds read/write leading to kernel panic or controlled memory corruption

How to detect it

Review kernel logs for ath11k oops, page faults, or warnings referencing hal_reo_error or REO destination rings; correlate with local process activity around WiFi receive processing.

What your security team should do

• Prioritize kernel updates on all systems using ath11k WiFi hardware
• Restrict local user access on multi-user systems until patched
• Monitor kernel logs for ath11k-related oops or page faults