CVE-2024-56543

What it actually does

Uninitialized rx_tid::ab pointer dereference during ath12k_dp_rx_frags_cleanup for the self peer object when dp_rx_peer_tid_cleanup runs on core halt or reset, because self peers bypass dp setup and never receive a valid sta pointer.

Why it matters to the business

Kernel warning or potential crash on systems using ath12k Wi-Fi hardware during driver unload, firmware reset, or interface teardown, leading to temporary loss of wireless connectivity and possible system instability.

How an attack unfolds

An attacker with local access or the ability to trigger Wi-Fi core resets (via power management, interface flaps, or firmware commands) can cause repeated ath12k_core_halt paths that invoke peer cleanup on the self peer, surfacing the invalid memory access.

How to fix it

Update to Linux kernel commit d73da0dd2853887b7aab71f0d572fd3314dafafe or later; apply the vendor-supplied stable kernel update that adds the peer::sta check to skip cleanup for the self peer.

How to confirm the fix worked

Confirm the patch is present by checking for the peer::sta guard in ath12k_dp_rx_peer_tid_cleanup; reproduce core halt conditions in a test environment and verify absence of the WARNING stack trace.

Typical attack path

1. Trigger ath12k core reset or halt condition
2. ath12k_mac_peer_cleanup_all iterates all peers including self peer
3. ath12k_dp_rx_peer_tid_cleanup calls ath12k_dp_rx_frags_cleanup
4. rx_tid::ab is accessed without prior dp setup for the self peer
5. Kernel emits WARNING at dp_rx.c:851

How to detect it

Search kernel logs for the exact WARNING at drivers/net/wireless/ath/ath12k/dp_rx.c:851 and the ath12k_dp_rx_frags_cleanup call trace; correlate with ath12k_core_reset or ath12k_core_halt events.

• WARNING: CPU.*at drivers/net/wireless/ath/ath12k/dp_rx.c:851
• ath12k_dp_rx_frags_cleanup+0xd2/0xe0 [ath12k]
• ath12k_dp_rx_peer_tid_cleanup+0x39/0xa0 [ath12k]
• ath12k_core_halt+0x3b/0x100 [ath12k]

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all affected ath12k systems
• Prioritize systems exposed to frequent Wi-Fi resets or used in production wireless infrastructure
• Monitor kernel logs for the specific ath12k_dp_rx_frags_cleanup warning until patches are deployed