CVE-2024-53191

What it actually does

Double free of dp->tx_ring[i].tx_status buffers in ath12k_dp_free when device unbind occurs after a firmware initialization error, triggering WARNING at mm/slub.c:free_large_kmalloc.

Why it matters to the business

Kernel warnings or instability on Linux systems with ath12k wireless hardware during driver unload or error paths, increasing support overhead and potential downtime.

How an attack unfolds

An attacker or test environment triggers MSI addressing failure during firmware init (reproducible in VMs), causing buffers to be freed early; subsequent ath12k_pci_remove then attempts the same free again.

How to fix it

Apply the upstream fix that sets tx_status buffers to NULL after the first release; update to a kernel containing commit resolving CVE-2024-53191.

How to confirm the fix worked

Reproduce init failure then unbind and confirm absence of free_large_kmalloc warning; verify buffer pointers are nulled in ath12k source.

Typical attack path

1. Cause firmware initialization error via VM or misconfigured hardware
2. Trigger device unbind or removal
3. Observe double-free warning in slub allocator

How to detect it

Search kernel logs and dmesg for free_large_kmalloc warnings originating from ath12k_dp_free or ath12k_core_deinit during pci_remove.

What your security team should do

• Prioritize kernel updates on systems with ath12k hardware
• Monitor kernel logs for slub double-free warnings
• Test wireless driver unload paths in lab environments