CVE-2024-50236

What it actually does

Memory allocated for MSDU context during ath10k management frame transmission is never freed on TX completion or in cleanup paths, causing gradual kernel memory exhaustion.

Why it matters to the business

Systems using affected wireless hardware may experience slow memory depletion over extended operation, eventually leading to reduced performance, failed operations, or system instability requiring reboots.

How an attack unfolds

An attacker with local access repeatedly triggers management frame transmissions through the ath10k driver; the leak accumulates because allocated objects are never released during completion or cleanup routines.

How to fix it

Update the Linux kernel to a version containing the fix that frees the allocated memory during management TX completion and cleanup, and protects the IDR removal with the data lock.

How to confirm the fix worked

After patching, run kmemleak or equivalent memory debugging tools while exercising management TX paths to confirm no new unreferenced objects appear; verify the presence of the corrected ath10k_wmi_tlv_op_cleanup_mgmt_tx_send logic.

Typical attack path

1. Obtain local access to a system with ath10k hardware
2. Generate repeated management frame transmission requests
3. Allow the driver to allocate context objects without corresponding frees
4. Monitor for increasing unreferenced kernel objects until resource pressure occurs

How to detect it

Review kernel logs and kmemleak reports for unreferenced objects allocated from ath10k_wmi_tlv_op_gen_mgmt_tx_send and ath10k_mgmt_over_wmi_tx_work paths; monitor for repeated allocation patterns without corresponding frees during management TX activity.

What your security team should do

• Apply the kernel update that resolves the leak as soon as it is available for the distribution
• Prioritize systems with ath10k wireless hardware that perform frequent management frame operations
• Enable kernel memory debugging in test environments to validate the fix before broad deployment