VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Apr 16, 2025· Updated Apr 6, 2026

CVE-2024-58096

CVE-2024-58096

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode

ath11k_hal_srng_* should be used with srng->lock to protect srng data.

For ath11k_dp_rx_mon_dest_process() and ath11k_dp_full_mon_process_rx(), they use ath11k_hal_srng_* for many times but never call srng->lock.

So when running (full) monitor mode, warning will occur: RIP: 0010:ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k] Call Trace: ? ath11k_hal_srng_dst_peek+0x18/0x30 [ath11k] ath11k_dp_rx_process_mon_status+0xc45/0x1190 [ath11k] ? idr_alloc_u32+0x97/0xd0 ath11k_dp_rx_process_mon_rings+0x32a/0x550 [ath11k] ath11k_dp_service_srng+0x289/0x5a0 [ath11k] ath11k_pcic_ext_grp_napi_poll+0x30/0xd0 [ath11k] __napi_poll+0x30/0x1f0 net_rx_action+0x198/0x320 __do_softirq+0xdd/0x319

So add srng->lock for them to avoid such warnings.

Inorder to fetch the srng->lock, should change srng's definition from 'void' to 'struct hal_srng'. And initialize them elsewhere to prevent one line of code from being too long. This is consistent with other ring process functions, such as ath11k_dp_process_rx().

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Missing lock in ath11k monitor mode causes race condition; fix adds srng->lock to protect ring data.

In the Linux kernel's ath11k wireless driver, the functions ath11k_dp_rx_mon_dest_process() and ath11k_dp_full_mon_process_rx() in monitor mode call ath11k_hal_srng_* operations without holding the srng->lock, leading to a race condition that can cause a kernel warning and potential crash [1]. The driver's shared ring buffer (srng) data must be accessed under a lock to prevent concurrent modifications, but these monitor-mode paths omitted the necessary synchronization.

The vulnerability is triggered when monitor mode is enabled on ath11k devices (e.g., WCN6855, QCN9074). An attacker with local access or the ability to trigger monitor mode operations could cause the driver to access shared ring buffer data without synchronization, leading to a denial of service via kernel panic. No authentication is required beyond the ability to enable monitor mode.

An attacker can cause a kernel warning (RIP in ath11k_hal_srng_dst_peek) and potentially crash the system, resulting in denial of service. The fix ensures proper locking by changing the srng definition from void to struct hal_srng and initializing it, consistent with other ring processing functions such as ath11k_dp_process_rx().

The fix has been applied in the Linux kernel stable tree. Users should update to a kernel version containing the referenced commit. No workaround is mentioned in the advisory.

References
  1. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

90

Patches

4
27ca8004ba93
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
1d2178918efc
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
b85758e76b64
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
63b7af49496d
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.