Executive brief
The Linux kernel's ath10k WiFi driver has a race condition where hardware copy engine CE3 (used for firmware commands) sends a completion interrupt while still accessing the buffer, but the driver immediately unmaps and frees it. This causes an IOMMU (SMMU) fault that crashes the system. The issue affects WCN3990 WiFi chips and manifests as kernel panics during driver operations.
Technical details
This is a use-after-free race condition in the ath10k WiFi driver's handling of DMA buffer unmapping on the WCN3990 SoC. The vulnerability occurs in copy engine channel 3 (CE3), which handles WMI command transmission to firmware. When the hardware copy engine completes a buffer transfer, it sends a completion interrupt to the host driver, which immediately unmaps and frees the DMA buffer. However, due to a timing issue on WCN3990, the hardware may still be accessing the buffer when unmapping occurs. This causes the IOMMU (ARM SMMU) to detect an invalid memory access and trigger a fatal fault, resulting in kernel panic. The fix introduces a conditional delay before unmapping the CE3 source DMA buffer, specific to WCN3990, to allow the hardware to fully complete its buffer access before the driver reclaims the memory.
Affected products
- Linux Linux kernel multiple versions with ath10k driver
- Qualcomm WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 and related
Timeline
- 2025-12-24: disclosed