Executive brief
A WiFi driver bug in the Linux kernel's ath11k module fails to properly initialize peer ID data structures during station disconnection events. This causes debug logging to reference uninitialized memory, potentially exposing sensitive kernel memory contents when debug features are enabled. The issue affects systems using Qualcomm WiFi hardware, particularly when performing network scans while disconnected.
Technical details
The vulnerability is an uninitialized variable issue in the ath11k WiFi driver's receive path. In ath11k_dp_rx_process_mon_status(), a memset clears ppdu_info but fails to reinitialize peer_id to HAL_INVALID_PEERID. When a station is disconnected and a scan occurs with peer_id=0, the missing initialization causes peer_id=0 to bypass the HAL_INVALID_PEERID check (0 != HAL_INVALID_PEERID), allowing an uninitialized ppdu_info structure to be logged. This occurs in the monitor status processing path, triggered by hardware interrupt context. The fix involves explicitly resetting peer_id and related fields to HAL_INVALID_PEERID after memset operations.
Affected products
- Linux Linux kernel version containing commit 01d2f285e3e5 and prior
Timeline
- 2025-12-09: disclosed