CVE-2024-58096

What it actually does

Missing srng->lock acquisition around ath11k_hal_srng_* calls in ath11k_dp_rx_mon_dest_process and ath11k_dp_full_mon_process_rx allows concurrent access to shared SRNG ring state during monitor-mode RX processing, producing warnings and potential data-structure corruption.

Why it matters to the business

Systems using ath11k Wi-Fi hardware in monitor or full-monitor mode may experience kernel warnings, reduced stability, or crashes; the low EPSS and absence from KEV indicate limited immediate operational risk but still require patching on affected kernels.

How an attack unfolds

An attacker with local access enables monitor mode on an ath11k device, then triggers concurrent RX ring processing paths that call unprotected ath11k_hal_srng_* functions, racing on internal ring pointers and metadata.

How to fix it

Update the Linux kernel to a version containing the fix that adds srng->lock protection and changes the relevant SRNG definitions from void to struct hal_srng; apply the exact fixed package versions listed for each distribution when they become available.

How to confirm the fix worked

Boot the patched kernel, enable monitor mode, exercise ath11k_dp_service_srng and mon-ring processing paths, and confirm the absence of the ath11k_hal_srng_dst_peek warning and related stack traces in dmesg or kernel logs.

Typical attack path

1. Obtain local user privileges on a system with ath11k hardware
2. Configure the interface into monitor or full-monitor mode
3. Generate traffic or use tools that exercise ath11k_dp_rx_process_mon_status and ath11k_dp_rx_process_mon_rings
4. Trigger simultaneous NAPI poll or service-SRNG paths to hit the unlocked ath11k_hal_srng_dst_peek and related calls

How to detect it

Search kernel logs and dmesg for the exact call trace beginning with RIP ath11k_hal_srng_dst_peek and the functions ath11k_dp_rx_process_mon_status, ath11k_dp_rx_process_mon_rings, and ath11k_dp_service_srng; monitor for repeated warnings when monitor mode is active.

• ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k]
• ath11k_dp_rx_process_mon_status+0xc45/0x1190 [ath11k]
• ath11k_dp_rx_process_mon_rings+0x32a/0x550 [ath11k]
• RIP: 0010:ath11k_hal_srng_dst_peek

What your security team should do

• Prioritize kernel updates on systems that use ath11k hardware and monitor mode
• Add the provided call-trace strings to SIEM rules for proactive detection until patches are deployed
• Review any downstream dependents or container images that ship the vulnerable ath11k driver