CVE-2026-23135

What it actually does

The ath12k driver passes aligned DMA addresses to dma_free_coherent instead of the original unaligned addresses returned by dma_alloc_coherent, causing the wrong buffer to be released and producing memory corruption or kernel crashes.

Why it matters to the business

Local users on affected Ubuntu 18.04 systems can trigger denial-of-service conditions that halt wireless functionality or destabilize the entire host, with elevated urgency for organizations still running the specified linux-aws-5.4 kernel packages.

How an attack unfolds

An attacker with local access loads or interacts with the ath12k Wi-Fi driver in a manner that exercises the DMA allocation and subsequent free paths; the mismatched pointers lead to invalid memory operations that corrupt kernel structures or cause a panic.

How to fix it

Upgrade linux-aws-5.4 on Ubuntu Pro 18.04 LTS to version 5.4.0-1104.112~18.04.1 or later; after installation, reboot the system and verify the running kernel version matches the fixed release.

How to confirm the fix worked

Confirm the installed package version is at or above 5.4.0-1104.112~18.04.1, then exercise Wi-Fi attach/detach sequences while monitoring for kernel oops or DMA-related warnings in dmesg.

Typical attack path

1. Obtain a local shell or user context on the target system
2. Trigger ath12k DMA buffer allocation through Wi-Fi operations or module loading
3. Force the driver to release the buffer using the incorrect aligned address
4. Induce kernel memory corruption or crash to achieve denial of service

How to detect it

Review kernel logs for ath12k DMA free warnings or general protection faults around wireless driver activity; no remote network indicators exist because exploitation requires local access.

What your security team should do

• Apply the fixed kernel package immediately on all Ubuntu Pro 18.04 instances using linux-aws-5.4
• Prioritize systems exposed to untrusted local users or containers
• Schedule a rolling reboot after package installation to activate the corrected driver
• Monitor vendor advisories for any additional backports to older kernel flavors