CVE-2024-43881 (GCVE-0-2024-43881)

Vulnerability from cvelistv5 – Published: 2024-08-21 00:06 – Updated: 2026-08-05 11:36
VLAI
Title
wifi: ath12k: change DMA direction while mapping reinjected packets
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: change DMA direction while mapping reinjected packets For fragmented packets, ath12k reassembles each fragment as a normal packet and then reinjects it into HW ring. In this case, the DMA direction should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise, an invalid payload may be reinjected into the HW and subsequently delivered to the host. Given that arbitrary memory can be allocated to the skb buffer, knowledge about the data contained in the reinjected buffer is lacking. Consequently, there’s a risk of private information being leaked. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < e99d9b16ff153de9540073239d24adc3b0a3a997 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 6925320fcd40d8042d32bf4ede8248e7a5315c3b (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 33322e3ef07409278a18c6919c448e369d66a18e (git)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.44 , ≤ 6.6.* (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43881",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:05:47.970201Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:15.718Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e99d9b16ff153de9540073239d24adc3b0a3a997",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "6925320fcd40d8042d32bf4ede8248e7a5315c3b",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "33322e3ef07409278a18c6919c448e369d66a18e",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: change DMA direction while mapping reinjected packets\n\nFor fragmented packets, ath12k reassembles each fragment as a normal\npacket and then reinjects it into HW ring. In this case, the DMA\ndirection should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise,\nan invalid payload may be reinjected into the HW and\nsubsequently delivered to the host.\n\nGiven that arbitrary memory can be allocated to the skb buffer,\nknowledge about the data contained in the reinjected buffer is lacking.\nConsequently, there\u2019s a risk of private information being leaked.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The trigger is a sequence of fragmented 802.11 data frames received over the air by the ath12k Wi-Fi driver, processed in the REO exception/defrag RX path. This requires the attacker to be within radio range on the same WLAN segment, which is CVSS Adjacent.\nAC:L - The attacker fully controls the trigger \u2014 simply send a fragmented MPDU sequence \u2014 with no race to win and no memory layout dependency; sizing the fragments above DP_RX_BUFFER_SIZE + tailroom deterministically forces the pskb_expand_head() path so the reinjected buffer is freshly allocated uninitialized heap. The affected platform class (DMA-noncoherent embedded ARM APs and SWIOTLB-bounced systems) is the primary deployment target for QCN9274/ath12k.\nPR:N - No privileges on the host are needed; the attacker only needs to be a peer sending fragments, and ath12k_dp_rx_h_defrag_validate_incr_pn() returns true unconditionally for non-CCMP/GCMP encryption, so open/guest/hotspot SSIDs and rogue-AP-against-STA scenarios have no authentication gate on this path.\nUI:N - The vulnerable code runs in the NAPI receive path and executes automatically on arrival of fragmented frames. No local user action of any kind is required.\nS:U - The mis-directioned DMA mapping and its consequences are confined to the kernel\u0027s own memory and the driver\u0027s RX pipeline, all within the same security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Up to a full RX buffer of arbitrary uninitialized kernel slab memory (recently freed heap that may contain keys, kernel pointers, or other packets\u0027 data) is handed to the Wi-Fi hardware and re-delivered as network payload, repeatably at frame rate; in the standard AP/bridge/repeater deployment it is forwarded onto the LAN or back over the air where the attacker can capture it. The upstream fix explicitly cites leakage of private information.\nI:H - The legitimate reassembled frame is silently replaced with unrelated memory that mac80211 accepts flagged RX_FLAG_DECRYPTED | RX_FLAG_PN_VALIDATED, i.e. arbitrary content is injected into the host\u0027s network stack and bridge as authenticated data from a trusted peer, bypassing link-layer integrity protection; an attacker able to groom the kernel heap can influence that content.\nA:H - The returned buffer is parsed as a hardware RX descriptor while containing uninitialized heap, and the is_frag branch in ath12k_dp_rx_process_msdu() skips the msdu_len bounds check, driving skb_pull/skb_push/memmove and rate decoding from garbage \u2014 e.g. nss==0 underflows rate_idx to \u003e2000 and trips mac80211\u0027s WARN_ON, which panics on panic_on_warn systems, alongside continuous RX-path corruption and frame loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:56.662Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e99d9b16ff153de9540073239d24adc3b0a3a997"
        },
        {
          "url": "https://git.kernel.org/stable/c/6925320fcd40d8042d32bf4ede8248e7a5315c3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/33322e3ef07409278a18c6919c448e369d66a18e"
        }
      ],
      "title": "wifi: ath12k: change DMA direction while mapping reinjected packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43881",
    "datePublished": "2024-08-21T00:06:33.622Z",
    "dateReserved": "2024-08-17T09:11:59.287Z",
    "dateUpdated": "2026-08-05T11:36:56.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43881",
      "date": "2026-08-10",
      "epss": "0.00306",
      "percentile": "0.22908"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: change DMA direction while mapping reinjected packets\\n\\nFor fragmented packets, ath12k reassembles each fragment as a normal\\npacket and then reinjects it into HW ring. In this case, the DMA\\ndirection should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise,\\nan invalid payload may be reinjected into the HW and\\nsubsequently delivered to the host.\\n\\nGiven that arbitrary memory can be allocated to the skb buffer,\\nknowledge about the data contained in the reinjected buffer is lacking.\\nConsequently, there\\u2019s a risk of private information being leaked.\\n\\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: wifi: ath12k: cambia la direcci\\u00f3n de DMA al mapear paquetes reinyectados. Para paquetes fragmentados, ath12k vuelve a ensamblar cada fragmento como un paquete normal y luego lo reinyecta en el anillo HW. En este caso, la direcci\\u00f3n DMA debe ser DMA_TO_DEVICE, no DMA_FROM_DEVICE. De lo contrario, se puede reinyectar una carga \\u00fatil no v\\u00e1lida en el HW y posteriormente entregarla al host. Dado que se puede asignar memoria arbitraria al b\\u00fafer skb, falta conocimiento sobre los datos contenidos en el b\\u00fafer reinyectado. En consecuencia, existe el riesgo de que se filtre informaci\\u00f3n privada. Probado en: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1\"}]",
      "id": "CVE-2024-43881",
      "lastModified": "2024-08-21T12:30:33.697",
      "published": "2024-08-21T01:15:12.280",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/33322e3ef07409278a18c6919c448e369d66a18e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6925320fcd40d8042d32bf4ede8248e7a5315c3b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e99d9b16ff153de9540073239d24adc3b0a3a997\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43881\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T01:15:12.280\",\"lastModified\":\"2026-08-04T11:19:57.530\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: change DMA direction while mapping reinjected packets\\n\\nFor fragmented packets, ath12k reassembles each fragment as a normal\\npacket and then reinjects it into HW ring. In this case, the DMA\\ndirection should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise,\\nan invalid payload may be reinjected into the HW and\\nsubsequently delivered to the host.\\n\\nGiven that arbitrary memory can be allocated to the skb buffer,\\nknowledge about the data contained in the reinjected buffer is lacking.\\nConsequently, there\u2019s a risk of private information being leaked.\\n\\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: wifi: ath12k: cambia la direcci\u00f3n de DMA al mapear paquetes reinyectados. Para paquetes fragmentados, ath12k vuelve a ensamblar cada fragmento como un paquete normal y luego lo reinyecta en el anillo HW. En este caso, la direcci\u00f3n DMA debe ser DMA_TO_DEVICE, no DMA_FROM_DEVICE. De lo contrario, se puede reinyectar una carga \u00fatil no v\u00e1lida en el HW y posteriormente entregarla al host. Dado que se puede asignar memoria arbitraria al b\u00fafer skb, falta conocimiento sobre los datos contenidos en el b\u00fafer reinyectado. En consecuencia, existe el riesgo de que se filtre informaci\u00f3n privada. Probado en: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/dp_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"e99d9b16ff153de9540073239d24adc3b0a3a997\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"6925320fcd40d8042d32bf4ede8248e7a5315c3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"33322e3ef07409278a18c6919c448e369d66a18e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/dp_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.44\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.3\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:05:47.970201Z\",\"id\":\"CVE-2024-43881\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.44\",\"matchCriteriaId\":\"E752D2D6-EE15-4491-857A-AA8D6AE62EDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"92D388F2-1EAF-4CFA-AC06-5B26D762EA7D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/33322e3ef07409278a18c6919c448e369d66a18e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6925320fcd40d8042d32bf4ede8248e7a5315c3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e99d9b16ff153de9540073239d24adc3b0a3a997\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:13:31+00:00",
      "cve": "CVE-2024-43881",
      "id": "CVE-2024-43881",
      "initial_release_date": "2024-08-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath12k: change DMA direction while mapping reinjected packets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-43881.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:53:48Z",
      "cve": "CVE-2024-43881",
      "id": "CVE-2024-43881",
      "initial_release_date": "2024-08-22T02:58:15Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "254",
      "product_status:recommended": "360",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-43881",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-43881.json",
      "version": "56"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43881\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:05:47.970201Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:19.051Z\"}}], \"cna\": {\"title\": \"wifi: ath12k: change DMA direction while mapping reinjected packets\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"e99d9b16ff153de9540073239d24adc3b0a3a997\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"6925320fcd40d8042d32bf4ede8248e7a5315c3b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"33322e3ef07409278a18c6919c448e369d66a18e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/dp_rx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/dp_rx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e99d9b16ff153de9540073239d24adc3b0a3a997\"}, {\"url\": \"https://git.kernel.org/stable/c/6925320fcd40d8042d32bf4ede8248e7a5315c3b\"}, {\"url\": \"https://git.kernel.org/stable/c/33322e3ef07409278a18c6919c448e369d66a18e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: change DMA direction while mapping reinjected packets\\n\\nFor fragmented packets, ath12k reassembles each fragment as a normal\\npacket and then reinjects it into HW ring. In this case, the DMA\\ndirection should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise,\\nan invalid payload may be reinjected into the HW and\\nsubsequently delivered to the host.\\n\\nGiven that arbitrary memory can be allocated to the skb buffer,\\nknowledge about the data contained in the reinjected buffer is lacking.\\nConsequently, there\\u2019s a risk of private information being leaked.\\n\\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.44\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:31:37.987Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43881\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:31:37.987Z\", \"dateReserved\": \"2024-08-17T09:11:59.287Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T00:06:33.622Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.