Linux Kernel ath11k Driver Use-After-Free Vulnerability on QCA6390/WCN6855

A use-after-free vulnerability has been identified in the Linux kernel's ath11k driver, specifically for QCA6390 and WCN6855 chipsets. The issue arises when the driver fails to properly delete peer references after a station disconnects from an access point. This oversight, intended to prevent a firmware crash by altering the sequence of Wireless Management Interface (WMI) commands, inadvertently skipped essential peer deletion operations. As a result, a dangling pointer issue emerged, leading to a use-after-free condition that was flagged by the Kernel Address Sanitizer (KASAN). The vulnerability allows for unauthorized memory access, which could be exploited to execute arbitrary code or cause a system crash.

Impact

Exploitation of this vulnerability causes a use-after-free condition, where memory that has already been freed is accessed again. This can lead to memory corruption, allowing an attacker to manipulate program execution, potentially leading to arbitrary code execution or causing the system to crash.