Loading story…
CVE-2024-57995 is a moderate-severity use-after-free flaw in the Linux kernel's Qualcomm ath12k Wi-Fi driver, affecting ath12k_mac_assign_vif_to_vdev(). An arvif object created on another radio can be freed by ath12k_mac_unassign_link_vif() and subsequently dereferenced. The vulnerability was introduced in Linux 6.10 and fixed upstream in stable kernel 6.13.2 and 6.14-rc1; the Linux kernel CVE team recommends upgrading to a current stable release rather than applying the isolated fix.
Red Hat assigned the vulnerability a CVSS v3.1 score of 6.7 and states exploitation requires local root privileges. Fixes are available for RHEL 9 and RHEL 10 through advisories RHSA-2025:20518 and RHSA-2025:20095; RHEL 6, 7, 7 kernel-rt, 8, and 8 kernel-rt are not affected, while RHEL 9 kernel-rt is listed as will not fix.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:20518 for the RHEL 9 kernel and RHSA-2025:20095 for the RHEL 10 kernel, addressing the ath12k use-after-free vulnerability.
The Linux kernel CVE team assigned CVE-2024-57995 to the ath12k use-after-free issue. Fixes were included in Linux 6.13.2 and 6.14-rc1 by moving the affected check until after arvif is reassigned.
The read-after-free condition in ath12k_mac_assign_vif_to_vdev() was introduced in Linux kernel 6.10. It can occur when ath12k_mac_unassign_link_vif() frees an arvif created on another radio before subsequent code reads it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52800** is a low-severity use-after-free vulnerability in the Linux kernel's `ath11k` Wi-Fi driver. In HTTP packet-log handling within `drivers/net/wireless/ath/ath11k/dp_rx.c`, code accessed RCU-protected active physical-device data through `ath11k_mac_get_ar_by_pdev_id()` without an RCU read-side critical section. The flaw, introduced in kernel 5.6, requires local access and high privileges; Red Hat assigned CVSS 4.4, citing potential availability impact with no confidentiality or integrity impact. Upstream fixes are available in Linux 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, 6.7, and later stable releases, and maintainers recommend updating to a current stable kernel rather than cherry-picking the patch. Red Hat remediated affected Red Hat Enterprise Linux 8 kernels through **RHSA-2024:7000**; RHEL 6 and 7 were assessed as not affected, while fixes for RHEL 8 `kernel-rt` and RHEL 9 kernel variants were deferred.
Aug 26, 2026
**CVE-2023-52798** is a use-after-free vulnerability in the Linux kernel's `ath11k` Wi-Fi driver, affecting DFS radar-event handling in `drivers/net/wireless/ath/ath11k/wmi.c`. Code invoking `ath11k_mac_get_ar_by_pdev_id()` accessed RCU-protected active physical-device data without an RCU read-side critical section, risking access to data after it had been freed. The flaw was introduced in Linux kernel 5.6. Upstream fixes mark the affected operation as an RCU read-side critical section and are available in kernel versions 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later stable releases. Red Hat rated the issue **Low** severity with a CVSS v3.1 score of 4.4, requiring local access and high privileges; RHEL 8 is fixed through `RHSA-2024:7000`, while RHEL 6 and 7 are unaffected and fixes for certain RHEL 8/9 real-time and RHEL 9 kernels were deferred.
Aug 26, 2026
**CVE-2024-58015** affects the Linux kernel's `ath12k` Wi-Fi driver, where debugfs handling of self-generated HTTP statistics passed an oversized array-length value to `print_array_to_buf_index()`. The off-by-one buffer bound can trigger an out-of-bounds memory read, potentially exposing local information or affecting system availability. The defect was identified through Coverity findings `CID 1600742` and `CID 1600758`. The upstream fix reduces the buffer size by one and is available in Linux kernel `6.13.3` and `6.14-rc1`; the Linux kernel CVE team recommends updating to a current stable release rather than selectively applying the patch. Red Hat rated the issue Moderate with CVSS 6.0, while NVD assigned 7.1. Red Hat issued fixes for RHEL 9 and RHEL 10 through `RHSA-2025:20518` and `RHSA-2025:20095`; RHEL 9 `kernel-rt` is marked will not fix, and RHEL 6, 7, 8 and their listed real-time kernel variants are not affected.
Aug 26, 2026