LiveActive security incident?Get immediate response
CVE Record

CVE-2024-43881: wifi: ath12k: change DMA direction while mapping reinjected packets

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: change DMA direction while mapping reinjected packets For fragmented packets, ath12k reassembles each fragment as a normal packet and then reinjects it into HW ring. In this case, the DMA direction should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise, an invalid payload may be reinjected into the HW and subsequently delivered to the host. Given that arbitrary memory can be allocated to the skb buffer, knowledge about the data contained in the reinjected buffer is lacking. Consequently, there’s a risk of private information being leaked. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel Wi-Fi driver flaw in ath12k. Fragmented Wi-Fi packets can be reassembled and reinjected with the wrong DMA direction, creating a risk that unintended memory contents are delivered back to the host. The public record describes possible private information leakage, but does not provide a CVSS score or confirmed exploitation.

Executive priority

Treat this as a targeted kernel information disclosure issue. It should be patched through normal kernel update cycles, with higher priority for managed endpoints or embedded devices using ath12k Wi-Fi in sensitive environments.

Technical view

The ath12k driver maps reinjected fragmented packets as DMA_FROM_DEVICE instead of DMA_TO_DEVICE. The kernel fix changes DMA direction for reinjected packets to avoid invalid payload reuse. The issue is tied to fragmented packet handling in ath12k; the record notes testing on QCN9274 hardware.

Likely exposure

Exposure is most likely on Linux systems using the ath12k Wi-Fi driver with affected kernel code, especially Qualcomm ath12k-supported hardware. Generic Linux servers without ath12k Wi-Fi are unlikely to be affected. Distro backports may change exact version exposure.

Exploitation context

The source bundle says KEV is false and provides no cited evidence of active exploitation. The described impact is information disclosure risk, not code execution. Practical exploitability is not fully established from the provided sources.

Researcher notes

Evidence is limited to the CVE description and kernel stable references. The record does not include CVSS, CWE, exploit status, or detailed affected-version ranges. Avoid over-scoping beyond Linux ath12k fragmented packet reinjection behavior.

Mitigation direction

  • Update to a vendor-supported kernel containing the referenced upstream stable fixes.
  • Prioritize laptops, appliances, and embedded systems using ath12k Wi-Fi hardware.
  • Check Linux distribution advisories for backported fixes and package-specific version guidance.
  • If updates are delayed, evaluate disabling affected Wi-Fi hardware where operationally acceptable.

Validation and detection

  • Inventory systems loading the ath12k driver or using Qualcomm ath12k-supported Wi-Fi adapters.
  • Compare deployed kernel packages against distribution advisories for CVE-2024-43881.
  • Confirm patched kernels include one of the referenced upstream stable commits or equivalent backport.
  • Review asset classes where Wi-Fi traffic may carry sensitive data.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-43881 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd889913205cf7ebda905b1e62c5867ed4e39f6c2, d889913205cf7ebda905b1e62c5867ed4e39f6c2, d889913205cf7ebda905b1e62c5867ed4e39f6c2unaffected
LinuxLinux6.3, 0, 6.6.44, 6.10.3, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.