CVE-2024-58096

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The entire code path is driven by 802.11 frames received over the air into the ath11k monitor destination/status rings, so the attacker only needs to be within WiFi radio range of the target. Per kernel scoring guidance, WiFi frame injection is Adjacent.

AC:LAttack complexity, low

The attacker controls both sides of the race by injecting frames — high-rate valid traffic drives the monitor status/dest NAPI (ext-IRQ groups 4-6) while malformed/error frames drive ath11k_dp_process_rxdma_err() on the same srng from groups 0-2 — and can widen the window arbitrarily by raising injection rate. The condition also fires spontaneously under normal load, as documented by the sibling fix 16c6c35c03ea reporting repeated invalid buf_id and RCU stalls on WCN6855.

PR:NPrivileges required, none

A monitor-mode ath11k radio captures raw frames from any transmitter in range with no association, no 4-way handshake and no credentials of any kind, so the attacker needs zero privileges on the target. The vulnerable ring processing runs entirely pre-authentication on received frames.

UI:NUser interaction, none

Monitor/full-monitor capture is passive and continuous; the reap timer and NAPI poll the rings automatically with no victim action required. The attacker simply transmits frames into the air.

S:UScope, unchanged

The corruption is confined to kernel memory (SRNG descriptors, sk_buff heap objects, DMA mappings) within the same security authority. No VM, IOMMU or sandbox boundary is crossed.

C:HConfidentiality impact, high

Desynchronized ring pointers cause stale/garbage descriptors to be parsed, and the resulting sw_cookie indexes pmon->link_desc_banks[] (size 8) with no bounds check, producing an out-of-array read whose vaddr/paddr are then dereferenced in ath11k_hal_rx_msdu_list_get() — an arbitrary kernel read primitive. The concurrent double-consumption of buf_ids additionally causes freed sk_buff contents to be read back as a hal_rx_desc.

I:HIntegrity impact, high

Two consumers resolving the same buf_id across non-atomic idr_find()/idr_remove() sections produce a double dma_unmap_single() and double dev_kfree_skb_any() — a double-free/use-after-free of an sk_buff, a well-known heap-corruption write primitive. ath11k_hal_srng_access_end() also publishes a torn tp to the device's shared pointer, letting the hardware DMA into buffers the host still owns.

A:HAvailability impact, high

The same-series commit 16c6c35c03ea documents this exact monitor destination ring desynchronization causing an infinite reap loop, RCU stall and kernel crash on WCN6855. The lockdep_assert_held() failures also produce WARNs that panic on panic_on_warn systems, and the UAF/double-free crashes the kernel outright.