VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-49930

CVE-2024-49930

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix array out-of-bound access in SoC stats

Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access.

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's ath11k WiFi driver, a flaw in statistics collection uses an incorrect ring ID, leading to an out-of-bounds array access that could crash the system.

Vulnerability

CVE-2024-49930 is an out-of-bounds read vulnerability in the ath11k wireless driver within the Linux kernel. The root cause is a mismatch in ring identifiers: the ath11k_soc_dp_stats::hal_reo_error array is sized for DP_REO_DST_RING_MAX entries, but ath11k_dp_process_rx() indexes it using the SRNG (Source Ring Network Group) ring ID instead of the normal ring ID. This indexing error causes the kernel to access memory beyond the allocated array bounds [1][3][4].

Exploitation

An attacker requires local access and the ability to trigger packet reception on an affected ath11k device—for example, by sending crafted Wi‑Fi frames to a system with a QCN9074 or similar Qualcomm wireless card. No special privileges beyond the ability to interact with the wireless interface are necessary; the flaw occurs during normal RX processing in the kernel [1][2].

Impact

Successful exploitation can result in a system crash (denial of service) due to the out-of-bounds memory access. Although the official description and references focus on the array bounds issue, the CVSS v3.1 score of 7.8 (High) reflects the potential for high impact on availability. No evidence of code execution or privilege escalation is provided in the available sources [1][2].

Mitigation

The fix corrects the indexing to use the normal ring ID directly, preventing the out-of-bounds access. The patch is included in the Linux kernel stable branch starting with commit 0f26f26944035ec67546a944f182cbad6577a9c0 [4]. Users should update their kernel to include this fix or apply the patch from the stable repository. The vulnerability also affects Siemens industrial products that incorporate the GNU/Linux subsystem; Siemens advisory SSA-355557 lists this CVE with a patch requirement [1][2].

References
  1. SSA-355557
  2. SSA-265688
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

153

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.