CVE-2024-49931

What it actually does

Out-of-bounds array access in ath12k_soc_dp_stats::hal_reo_error caused by using SRNG ring ID instead of normal ring ID in ath12k_dp_rx_process() when processing REO destination rings.

Why it matters to the business

Systems running affected Linux kernels with ath12k WiFi hardware face risk of crashes, memory corruption, or potential code execution; widespread kernel exposure increases operational disruption and patching urgency across server and endpoint fleets.

How an attack unfolds

An attacker sends crafted wireless frames that reach ath12k_dp_rx_process() with a ring ID outside the allocated DP_REO_DST_RING_MAX bounds, triggering the out-of-bounds read/write; threat actors have shown interest in similar Linux kernel out-of-bounds issues in espionage and financially motivated campaigns.

How to fix it

Update to the fixed kernel commit d0e4274d9dc9f8409d56d622cd3ecf7b6fd49e2f or later; apply vendor backports that replace SRNG ring ID usage with normal ring ID in ath12k_dp_rx_process(); verify patch application via kernel source or package version checks.

How to confirm the fix worked

Confirm kernel source contains the corrected ring ID handling; test by exercising ath12k_dp_rx_process() with boundary ring IDs and verify no out-of-bounds access occurs via kernel debugging or static analysis tools.

Typical attack path

1. Identify target systems running vulnerable ath12k driver in Linux kernel
2. Craft and transmit wireless frames that exercise the REO destination ring processing path
3. Supply ring ID values that exceed the hal_reo_error array size
4. Trigger out-of-bounds access leading to crash or memory corruption for further exploitation

How to detect it

Search kernel logs and crash dumps for ath12k_soc_dp_stats or hal_reo_error references near ring processing failures; monitor for unexpected ath12k driver oops or memory access violations in system logs.

What your security team should do

• Prioritize kernel updates on all systems using ath12k hardware
• Monitor vendor advisories for ath12k and Linux kernel releases
• Restrict wireless exposure on critical systems until patched
• Review logs for ath12k driver anomalies as a temporary detection measure