CVE-2024-57995

What it actually does

Read-after-free vulnerability in ath12k_mac_assign_vif_to_vdev() where arvif pointer is freed via ath12k_mac_unassign_link_vif() on a different radio and then dereferenced before reassignment via ath12k_mac_assign_link_vif().

Why it matters to the business

Potential system crashes or local privilege escalation on wireless-enabled Linux systems; low exploitation likelihood given EPSS of 0.00364 with only +7% trend and no KEV listing, though the 608-day publication age and related kernel privilege escalation actor activity warrant monitoring.

How an attack unfolds

An attacker with local access triggers vif assignment across radios to cause the free of arvif, then performs operations that dereference the freed pointer before reassignment; context from associated Linux kernel privilege escalation activity (CVE-2025-21702) suggests possible chaining for elevated access.

How to fix it

Apply the upstream kernel fix that moves the arvif check after ath12k_mac_assign_link_vif() call; monitor for distribution backports; no langchain remediation applies despite erroneous package listings.

How to confirm the fix worked

Confirm kernel version contains the reordered check after ath12k_mac_assign_link_vif(); review ath12k driver source for the fix and test wireless interface assignment scenarios on QCN9274 hardware.

Typical attack path

1. Obtain local access on affected Linux system
2. Trigger ath12k_mac_assign_vif_to_vdev() with cross-radio vif assignment
3. Force ath12k_mac_unassign_link_vif() to free arvif
4. Dereference the freed arvif pointer before reassignment
5. Leverage resulting memory corruption for crash or escalation

How to detect it

Review kernel logs for ath12k driver warnings around vif assignment and unassignment sequences; inspect for use-after-free reports in dmesg or panic logs on systems with QCN9274 hardware; correlate with local process activity attempting wireless configuration changes.

What your security team should do

• Prioritize kernel updates on systems using ath12k wireless drivers
• Monitor EPSS trend and any new threat actor activity around related kernel flaws
• Harden local access controls to reduce attack surface for use-after-free exploitation
• Validate wireless driver behavior post-update using the provided test hardware configuration