The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: fix kernel crash during resume
Currently during resume, QMI target memory is not properly handled, resulting in kernel crash in case DMA remap is not supported:
BUG: Bad page state in process kworker/u16:54 pfn:36e80 page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36e80 page dumped because: nonzero _refcount Call Trace: bad_page free_page_is_bad_report __free_pages_ok __free_pages dma_direct_free dma_free_attrs ath12k_qmi_free_target_mem_chunk ath12k_qmi_msg_mem_request_cb
The reason is: Once ath12k module is loaded, firmware sends memory request to host. In case DMA remap not supported, ath12k refuses the first request due to failure in allocating with large segment size:
ath12k_pci 0000:04:00.0: qmi firmware request memory request ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 7077888 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 8454144 ath12k_pci 0000:04:00.0: qmi dma allocation failed (7077888 B type 1), will try later with small size ath12k_pci 0000:04:00.0: qmi delays mem_request 2 ath12k_pci 0000:04:00.0: qmi firmware request memory request
Later firmware comes back with more but small segments and allocation succeeds:
ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 262144 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 65536 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288
Now ath12k is working. If suspend is triggered, firmware will be reloaded during resume. As same as before, firmware requests two large segments at first. In ath12k_qmi_msg_mem_request_cb() segment count and size are assigned:
ab->qmi.mem_seg_count == 2 ab->qmi.target_mem[0].size == 7077888 ab->qmi.target_mem[1].size == 8454144
Then allocation failed like before and ath12k_qmi_free_target_mem_chunk() is called to free all allocated segments. Note the first segment is skipped because its v.addr is cleared due to allocation failure:
chunk->v.addr = dma_alloc_coherent()
Also note that this leaks that segment because it has not been freed.
While freeing the second segment, a size of 8454144 is passed to dma_free_coherent(). However remember that this segment is allocated at the first time firmware is loaded, before suspend. So its real size is 524288, much smaller than 8454144. As a result kernel found we are freeing some memory which is in use and thus cras ---truncated---
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-debugUpgrade kselftests-kmp-rtUpgrade dlm-kmp-azureUpgrade dtb-appleUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-64kbUpgrade kernel-macrosUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-debug-livepatch-develUpgrade kernel-default-baseUpgrade kernel-source-rtUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-renesasUpgrade dtb-amdUpgrade kernel-default-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-syms-rtUpgrade reiserfs-kmp-rtUpgrade dtb-broadcomUpgrade kernel-default-extraUpgrade kernel-rt_debug-vdsoUpgrade dtb-freescaleUpgrade dtb-hisiliconUpgrade kernel-azure-vdsoUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-docsUpgrade dtb-marvellUpgrade dtb-socionextUpgrade kernel-azure-extraUpgrade dtb-amazonUpgrade kernel-rt-optionalUpgrade kernel-symsUpgrade ocfs2-kmp-64kbUpgrade dtb-apmUpgrade kernel-defaultUpgrade dtb-amlogicUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-default-optionalUpgrade kernel-rt-extraUpgrade dtb-xilinxUpgrade dtb-lgUpgrade dtb-armUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-devel-rtUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-azure-optionalUpgrade kernel-source-vanillaUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmall-develUpgrade kernel-azureUpgrade dtb-qcomUpgrade kernel-64kb-develUpgrade ocfs2-kmp-rtUpgrade kernel-rt-develUpgrade dtb-caviumUpgrade cluster-md-kmp-azureUpgrade kernel-rtUpgrade dtb-alteraUpgrade kernel-devel-azureUpgrade dtb-rockchipUpgrade kernel-azure-livepatch-develUpgrade dtb-mediatekUpgrade dtb-exynosUpgrade kernel-obs-buildUpgrade kernel-source-azureUpgrade kernel-kvmsmallUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-develUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kernel-azure-develUpgrade gfs2-kmp-rt | Aug 8, 2024 | Jul 12, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracleUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-gcpUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1014-azureUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-azure-fdeUpgrade linux-image-ibm-classicUpgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-45-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-oem-22.04cUpgrade linux-image-ibmUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-virtualUpgrade linux-image-nvidiaUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1015-awsUpgrade linux-image-oem-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-gkeUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-generic | Sep 12, 2024 | Jul 12, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub