Executive brief
A WiFi driver module (ath11k) in the Linux kernel crashes with a NULL pointer exception when sending network data on certain Qualcomm IPQ5018 chipsets. This causes the WiFi interface to become unavailable, disrupting network connectivity for devices using this hardware until the system is rebooted or the driver is reloaded.
Technical details
The vulnerability is a NULL pointer dereference in the ath11k WiFi driver for IPQ5018 SoCs. The root cause is that the hw_ops->get_ring_selector() function pointer is not initialized for IPQ5018, but the driver calls it during packet transmission in ath11k_dp_tx(). When data transmission occurs after clients connect, the uninitialized function pointer causes a kernel panic. The attack vector is local/adjacent through normal network operations (sending data), requiring an active WiFi connection. The fix involves adding the missing hw_ops->get_ring_selector() initialization for the IPQ5018 platform in the driver code.
Affected products
- Linux Linux kernel versions with ath11k driver before CVE-2023-54141 fix
Timeline
- 2025-12-24: disclosed