LiveActive security incident?Get immediate response
CVE Record

CVE-2024-53188: wifi: ath12k: fix crash when unbinding

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix crash when unbinding If there is an error during some initialization related to firmware, the function ath12k_dp_cc_cleanup is called to release resources. However this is released again when the device is unbinded (ath12k_pci), and we get: BUG: kernel NULL pointer dereference, address: 0000000000000020 at RIP: 0010:ath12k_dp_cc_cleanup.part.0+0xb6/0x500 [ath12k] Call Trace: ath12k_dp_cc_cleanup ath12k_dp_free ath12k_core_deinit ath12k_pci_remove ... The issue is always reproducible from a VM because the MSI addressing initialization is failing. In order to fix the issue, just set to NULL the released structure in ath12k_dp_cc_cleanup at the end.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A cleanup error in Linux’s Qualcomm ath12k Wi-Fi driver can crash the kernel when a device is removed after firmware-related initialization fails. Successful triggering could disrupt affected systems; the supplied CVSS assessment also indicates possible confidentiality and integrity impact, although the source description only demonstrates a crash.

Executive priority

Treat this as a high-priority reliability and local-security update for systems using ath12k hardware, especially virtualized or operationally sensitive hosts. It is not supported as an internet-wide emergency because the evidence indicates local access, hardware-specific exposure, and no confirmed active exploitation.

Technical view

CVE-2024-53188 is a NULL-pointer dereference caused by ath12k cleanup running twice. After ath12k_dp_cc_cleanup releases a structure during failed initialization, ath12k_pci device unbinding can release it again. The kernel fix sets the released structure to NULL after cleanup. The supplied CVSS v3.1 score is 7.8, requiring local access and low privileges.

Likely exposure

Exposure is limited to Linux systems using the ath12k PCI wireless driver and a vulnerable kernel revision. The bundle lists affected kernel versions or boundaries including 6.3, 6.6.64, 6.11.11, 6.12.2, and 6.13, but its version data is ambiguous. Confirm status through kernel or distribution guidance.

Exploitation context

The bundle reports reliable reproduction in a VM because MSI addressing initialization fails. It does not establish malicious exploitation, a public exploit, remote reachability, or CISA KEV listing. The supplied vector describes a local, low-privilege condition requiring no user interaction; practical exploitability beyond denial of service remains unclear.

Researcher notes

The described root cause is repeated resource cleanup after a firmware-related initialization failure, categorized as CWE-476. The fix nulls the released structure, preventing subsequent cleanup from dereferencing it. Four stable-kernel commits are supplied, likely reflecting maintained branches. The bundle does not provide sufficient mapping to declare every fixed or vulnerable release precisely.

Mitigation direction

  • Inventory systems loading ath12k or ath12k_pci and record their exact kernel package versions.
  • Check kernel and Linux distribution advisories for whether each deployed build contains the referenced fix.
  • Apply the vendor-supported kernel update incorporating the applicable stable patch.
  • Restrict local access on exposed systems until updates can be deployed.
  • Follow vendor guidance if an updated kernel is not yet available.

Validation and detection

  • Confirm the running kernel version and distribution package revision after remediation.
  • Verify the applicable stable fix is included in the deployed kernel source or vendor changelog.
  • Check logs for ath12k initialization failures, NULL-pointer dereferences, or crashes during device removal.
  • Test device initialization and removal safely in a controlled environment after updating.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-476: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-53188 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-53188Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd889913205cf7ebda905b1e62c5867ed4e39f6c2, d889913205cf7ebda905b1e62c5867ed4e39f6c2, d889913205cf7ebda905b1e62c5867ed4e39f6c2, d889913205cf7ebda905b1e62c5867ed4e39f6c2unaffected
LinuxLinux6.3, 0, 6.6.64, 6.11.11, 6.12.2, 6.13affected
Weakness

CWE details

CWE-476

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-476 · source CWE mapping

NULL Pointer Dereference

NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs