Executive brief
The Linux kernel's ath12k WiFi driver contains a memory leak in the TKIP MIC (Message Integrity Code) verification function. When processing certain malformed wireless frames, the driver fails to release allocated memory, causing gradual memory exhaustion. This could degrade system performance or cause denial of service on systems relying on WiFi for connectivity.
Technical details
The vulnerability is a resource leak (memory leak) in the ath12k_wifi7_dp_rx_h_verify_tkip_mic() function within the ath12k WiFi 7 driver. When the NWIFI header length validation fails via ath12k_dp_rx_check_nwifi_hdr_len_valid(), the function returns -EINVAL but does not free the associated MSDU (MAC Service Data Unit) socket buffer before propagating the error up to ath12k_wifi7_dp_rx_h_defrag(). The defragmentation path then clears its reference to the MSDU by setting first_frag to NULL, orphaning the buffer and preventing its deallocation. The fix adds an explicit dev_kfree_skb_any(msdu) call before returning the error. This is a local issue triggered by receipt of specially crafted wireless frames; no authentication or special privileges are required.
Affected products
- Linux Linux kernel 5.x through 7.x (ath12k driver)
Timeline
- 2026-08-15: disclosed
- 2026-06-01: patched: Upstream fix committed
- 2026-07-24: patched: Stable kernel release