In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
Currently, there is no terminator entry for ath12k_qmi_msg_handlers hence facing below KASAN warning,
================================================================== BUG: KASAN: global-out-of-bounds in qmi_invoke_handler+0xa4/0x148 Read of size 8 at addr ffffffd00a6428d8 by task kworker/u8:2/1273
CPU: 0 PID: 1273 Comm: kworker/u8:2 Not tainted 5.4.213 #0 Workqueue: qmi_msg_handler qmi_data_ready_work Call trace: dump_backtrace+0x0/0x20c show_stack+0x14/0x1c dump_stack+0xe0/0x138 print_address_description.isra.5+0x30/0x330 __kasan_report+0x16c/0x1bc kasan_report+0xc/0x14 __asan_load8+0xa8/0xb0 qmi_invoke_handler+0xa4/0x148 qmi_handle_message+0x18c/0x1bc qmi_data_ready_work+0x4ec/0x528 process_one_work+0x2c0/0x440 worker_thread+0x324/0x4b8 kthread+0x210/0x228 ret_from_fork+0x10/0x18
The address belongs to the variable: ath12k_mac_mon_status_filter_default+0x4bd8/0xfffffffffffe2300 [ath12k] [...] ==================================================================
Add a dummy terminator entry at the end to assist the qmi_invoke_handler() in traversing up to the terminator entry without accessing an out-of-boundary index.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade kernel-rtUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade dtb-xilinxUpgrade kernel-64kbUpgrade kernel-sourceUpgrade kernel-azure-develUpgrade kernel-debug-develUpgrade dtb-amdUpgrade kernel-devel-azureUpgrade kernel-64kb-develUpgrade kernel-kvmsmallUpgrade kernel-rt-livepatch-develUpgrade dtb-apmUpgrade kernel-default-develUpgrade dtb-mediatekUpgrade kernel-macrosUpgrade kernel-docsUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-rtUpgrade dtb-qcomUpgrade kernel-azure-livepatch-develUpgrade dtb-armUpgrade kernel-kvmsmall-develUpgrade kernel-syms-rtUpgrade kernel-devel-rtUpgrade kernel-syms-azureUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade dtb-hisiliconUpgrade dlm-kmp-defaultUpgrade dtb-socionextUpgrade kernel-rt-develUpgrade gfs2-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-obs-qaUpgrade kernel-debug-livepatch-develUpgrade kernel-debugUpgrade kernel-default-optionalUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade dlm-kmp-azureUpgrade dtb-sprdUpgrade kernel-defaultUpgrade dtb-marvellUpgrade kernel-default-baseUpgrade kernel-debug-vdsoUpgrade kernel-obs-buildUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade kernel-default-livepatchUpgrade dtb-alteraUpgrade dtb-caviumUpgrade dtb-allwinnerUpgrade dtb-lgUpgrade dlm-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-rt-extraUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade dtb-appleUpgrade dtb-nvidiaUpgrade kernel-source-rtUpgrade kernel-source-vanillaUpgrade dtb-rockchipUpgrade cluster-md-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-rt_debug-develUpgrade kernel-develUpgrade kernel-default-base-rebuildUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-optionalUpgrade dtb-renesasUpgrade dtb-amazonUpgrade kernel-azure-optionalUpgrade kselftests-kmp-azureUpgrade dtb-freescaleUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade dtb-broadcomUpgrade cluster-md-kmp-rtUpgrade dtb-exynosUpgrade ocfs2-kmp-azure | Jul 23, 2024 | Jun 19, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-nvidia-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-oem-24.04Upgrade linux-image-gkeUpgrade linux-image-oracleUpgrade linux-image-virtualUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-kvmUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-raspiUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-ibmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-azureUpgrade linux-image-lowlatencyUpgrade linux-image-genericUpgrade linux-image-6.8.0-1012-gcp | Aug 9, 2024 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub