Linux Kernel ath11k Double Free Vulnerability

A double free vulnerability has been identified in the Linux kernel's ath11k wireless driver for Qualcomm IEEE 802.11ax devices. This issue arises when an error occurs during firmware initialization, leading to the premature release of transmission status buffers. These buffers are subsequently released again when the device is unbound, causing a double free condition. The vulnerability is consistently reproducible in a virtual machine environment due to a failure in the Message Signaled Interrupts (MSI) addressing initialization.

Impact

Exploitation of this vulnerability leads to a double free condition, which can commonly result in memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by causing a failure in the MSI addressing initialization while using a virtual machine. This can be done by unbinding the ath11k_pci device after a firmware initialization error, which triggers the double free condition.

Remediation

The vulnerability has been addressed in the Linux kernel stable tree. Users can upgrade to the latest version of the kernel to apply the fix.