{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-57995","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-02-27T02:04:28.914Z","datePublished":"2025-02-27T02:07:16.163Z","dateUpdated":"2026-08-05T11:47:14.855Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:47:14.855Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()\n\nIn ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different\nradio, it gets deleted from that radio through a call to\nath12k_mac_unassign_link_vif(). This action frees the arvif pointer.\nSubsequently, there is a check involving arvif, which will result in a\nread-after-free scenario.\n\nFix this by moving this check after arvif is again assigned via call to\nath12k_mac_assign_link_vif().\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable code is a mac80211 chanctx-assignment op driven by 802.11 events — cross-radio scanning, band steering/BSS-transition requests, channel-switch announcements and MLO link reconfiguration — so an attacker within WiFi range (rogue/evil-twin AP or frame injection) can drive the radio migration that frees the arvif.\nAC:L - The attacker can repeatedly force band/radio migrations of the link vif via beacons, CSA and MLO link reconfiguration, and the freeing plus the stale read happen deterministically on that path with no race to win; heap grooming to control the reallocated object is standard.\nPR:N - An adjacent 802.11 attacker needs no credentials on the target — background scans and auto-connect to a spoofed known SSID reach the path pre-authentication, and no local account or capability is required.\nUI:N - Background scanning across radios and auto-reconnect to saved networks occur without any user action, and CSA/band-steering frames are processed automatically by the connected station.\nS:U - The freed object, the corrupted structures and the resulting code execution all reside in the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - Taking the `goto flush` branch runs `ath12k_mac_vif_cache_flush()` on the freed arvif, using freed bytes as `arvif->link_id` to index `ahvif->cache[]` and returning `arvif->ar` from freed memory for the caller to dereference — an out-of-bounds/arbitrary read primitive over kernel memory.\nI:H - The same use-after-free path performs writes through freed-memory-derived pointers (`ath12k_mac_bss_info_changed()`, `ath12k_mac_conf_tx()`, key-cache flush, and the caller's `arvif->punct_bitmap` store), giving a heap-spray-controlled write primitive suitable for control-flow hijack.\nA:H - Dereferencing freed and reallocated memory as pointers reliably produces a kernel oops/panic even when not exploited further, taking down the affected system."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath12k/mac.c"],"versions":[{"version":"b5068bc9180d06a5ac242b0f9263047c14f86211","lessThan":"57100b87c77818cb0d582a92e5cb32fff85c757d","status":"affected","versionType":"git"},{"version":"b5068bc9180d06a5ac242b0f9263047c14f86211","lessThan":"f3a95a312419e4f1e992525917da9dbcd247038f","status":"affected","versionType":"git"},{"version":"b5068bc9180d06a5ac242b0f9263047c14f86211","lessThan":"5a10971c7645a95f5d5dc23c26fbac4bf61801d0","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath12k/mac.c"],"versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","status":"unaffected","versionType":"semver"},{"version":"6.12.57","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.2","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.12.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.13.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/57100b87c77818cb0d582a92e5cb32fff85c757d"},{"url":"https://git.kernel.org/stable/c/f3a95a312419e4f1e992525917da9dbcd247038f"},{"url":"https://git.kernel.org/stable/c/5a10971c7645a95f5d5dc23c26fbac4bf61801d0"}],"title":"wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-57995","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-10-01T19:31:23.714588Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-416","description":"CWE-416 Use After Free"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-10-01T19:36:42.461Z"}}]}}