Executive brief
The Linux kernel's ath10k Wi-Fi driver contains a memory copying bug that causes crashes on ARM-based systems when collecting diagnostic firmware dumps. When the driver attempts to save device memory during error recovery, it uses an unaligned memory copy operation that triggers a kernel panic, preventing both the dump collection and modem recovery, which disrupts device connectivity.
Technical details
The vulnerability is an alignment fault (FSC=0x21) in the ath10k_msa_dump_memory() function in drivers/net/wireless/ath/ath10k/snoc.c. The root cause is use of memcpy() to copy from a device-memory region (mapped with devm_memremap(MEMREMAP_WT)) that does not permit unaligned accesses on arm64. The optimized memcpy implementation issues wide/unaligned loads that violate the memory mapping constraints. This occurs in ath10k_snoc_fw_crashed_dump() during devcoredump collection and results in kernel panic, leaving the firmware RAM dump buffer zeroed and breaking modem SSR recovery. The fix replaces memcpy() with memcpy_fromio(), which performs only aligned, word-sized reads compatible with device-memory mappings. No CVSS score or active exploitation reported; patch available in stable Linux kernel trees.
Affected products
- Linux Linux kernel Multiple versions (patch applied to stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched