Executive brief
The ath11k wireless driver in the Linux kernel had a bug where uninitialized message handler structures could cause the QMI (Qualcomm Message Interface) module to enter an infinite loop while searching for message handlers. This can cause system instability, denial of service, or out-of-bounds memory access on affected Linux systems running wireless devices that use the ath11k driver.
Technical details
The vulnerability is an improper data structure initialization flaw in the ath11k QMI message handler code (drivers/net/wireless/ath/ath11k/qmi.c). The qmi_msg_handler array requires a null terminator but was missing it, causing the QMI module's search logic in qmi_invoke_handler() to potentially iterate out of bounds when searching for a handler for a message ID that is not present in the handlers array. This results in an infinite loop followed by out-of-bounds memory access. The fix adds a proper null-terminated empty structure entry at the end of the qmi_msg_handler array. No special preconditions are required; the vulnerability is triggered during normal message processing on affected kernel versions.
Affected products
- Linux Linux Kernel 5.x, 6.x and later versions (ath11k driver component affected across multiple kernel versions)
Timeline
- 2025-12-30: disclosed
- 2022-10-21: patched: Upstream patch committed; stable kernel backport merged 2022-12-31