wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.17 % · centile 6 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the NWIFI header length is invalid, causing the function to abort early with -EINVAL. When this happens, the error propagates to ath12k_wifi7_dp_rx_h_defrag(), which clears first_frag by setting it to NULL. As a result, the corresponding MSDU is no longer referenced by the defragmentation path and is never freed. This leads to a memory leak for the affected MSDU on this error path. Proper cleanup is required to ensure the MSDU is released when header validation fails during TKIP MIC verification. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Références
- https://git.kernel.org/stable/c/d960cd5dbcc6a01f49cc304b724f6b18a63a172d
- https://git.kernel.org/stable/c/779ab501dc8f1148b3f10740a68335741bdc5ffe
- https://git.kernel.org/stable/c/55c6f05b667726d2da5fd011d646fb48ce5b6b9c
- https://git.kernel.org/stable/c/5187a92099778501f21af76ed6c8415d128e7298
- https://git.kernel.org/stable/c/98d4f92ab6a1af2ea2ab590d7e2801b203110981
Références européennes
- ENISA EUVD · EUVD-2026-59515
- GCVE · GCVE-0-2026-74368
Avis du CERT-FR
- CERTFR-2026-AVI-1432 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c < d960cd5dbcc6a01f49cc304b724f6b18a63a172d ; affected 3abe15e756481c45f6acba3d476cb3ca4afc3b61 < 779ab501dc8f1148b3f10740a68335741bdc5ffe ; affected 9a0dddfb30f120db3851627935851d262e4e7acb < 55c6f05b667726d2da5fd011d646fb48ce5b6b9c ; affected 9a0dddfb30f120db3851627935851d262e4e7acb < 5187a92099778501f21af76ed6c8415d128e7298 ; affected 9a0dddfb30f120db3851627935851d262e4e7acb < 98d4f92ab6a1af2ea2ab590d7e2801b203110981 ; affected 6ee653194ddb83674913fd2727b8ecfae0597ade |
| Linux · Linux | affected 6.15 ; unaffected 0 < 6.15 ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.18.57 ≤ 6.18.* ; unaffected 7.1.5 ≤ 7.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |