CVE-2024-53188

What it actually does

Double call to ath12k_dp_cc_cleanup after firmware init error releases the same structure twice, resulting in a NULL pointer dereference on subsequent unbind in ath12k_pci_remove.

Why it matters to the business

Kernel crashes and system instability on affected Wi-Fi hardware during driver unload or error recovery paths, leading to unexpected downtime and loss of wireless connectivity.

How an attack unfolds

An attacker or automated process triggers a firmware initialization failure (such as MSI setup errors common in virtualized environments), followed by device unbind or removal, which invokes the cleanup routine a second time and dereferences a freed pointer.

How to fix it

Apply the upstream fix in commit 81da9c0854545c3188ca2a09afe7cb65f9c012b5 or later stable kernels that set the released structure to NULL after cleanup; rebuild and deploy updated kernel packages for all affected distributions.

How to confirm the fix worked

Confirm the patch is present by checking for the NULL assignment at the end of ath12k_dp_cc_cleanup in the ath12k source; test reproduction steps in a VM to verify no crash occurs on init failure followed by unbind.

Typical attack path

1. Trigger firmware-related initialization error in ath12k
2. Cause device unbind or pci_remove path
3. ath12k_dp_cc_cleanup executes on already-released memory
4. Kernel hits NULL dereference and panics

How to detect it

Review kernel logs for BUG: kernel NULL pointer dereference traces containing ath12k_dp_cc_cleanup, ath12k_dp_free, and ath12k_pci_remove; correlate with ath12k firmware load failure messages.

What your security team should do

• Prioritize kernel updates on systems using ath12k hardware
• Monitor for kernel oops involving ath12k_dp_cc_cleanup
• Restrict unprivileged access to driver unload or PCI hotplug where feasible