Executive brief
The Qualcomm ath11k Wi-Fi driver crashes with a NULL pointer error when bringing up an interface in monitor mode. This causes system instability and service disruption but does not directly lead to data theft or unauthorized access. The issue occurs during packet handling and is triggered by a specific code path when the driver attempts to extract packet type information that is unnecessary for monitor mode operations.
Technical details
The vulnerability is a NULL pointer dereference in the ath11k driver's monitor mode packet delivery path. When an interface is brought up in monitor mode, the driver calls ath11k_hw_qcn9074_rx_desc_get_decap_type() on raw monitor packets without proper validation, attempting to extract packet type information that is not needed for monitor mode (which handles only raw packets). The vulnerable code path is triggered when monitor ring packets are processed through ath11k_dp_rx_deliver_msdu() and ath11k_dp_rx_mon_deliver() without the RX_FLAG_ONLY_MONITOR flag set. The fix involves appending the RX_FLAG_ONLY_MONITOR flag to skip unnecessary packet type extraction during monitor mode operation. This is a local denial-of-service condition affecting systems using the QCN9074 Wi-Fi chipset.
Affected products
- Linux Linux kernel 6.1.0-rc5 and prior (ath11k driver)
Timeline
- 2025-12-08: disclosed: CVE published
- patched: Fix applied to kernel by skipping packet type extraction in monitor mode