Loading story…
CVE-2023-52800 is a low-severity use-after-free vulnerability in the Linux kernel's ath11k Wi-Fi driver. In HTTP packet-log handling within drivers/net/wireless/ath/ath11k/dp_rx.c, code accessed RCU-protected active physical-device data through ath11k_mac_get_ar_by_pdev_id() without an RCU read-side critical section. The flaw, introduced in kernel 5.6, requires local access and high privileges; Red Hat assigned CVSS 4.4, citing potential availability impact with no confidentiality or integrity impact.
Upstream fixes are available in Linux 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, 6.7, and later stable releases, and maintainers recommend updating to a current stable kernel rather than cherry-picking the patch. Red Hat remediated affected Red Hat Enterprise Linux 8 kernels through RHSA-2024:7000; RHEL 6 and 7 were assessed as not affected, while fixes for RHEL 8 kernel-rt and RHEL 9 kernel variants were deferred.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat addressed CVE-2023-52800 in the Red Hat Enterprise Linux 8 kernel through advisory RHSA-2024:7000. Red Hat classified the issue as Low severity with a CVSS v3.1 score of 4.4; RHEL 6 and 7 were assessed as unaffected, while fixes for specified RHEL 8 and 9 kernel variants were deferred.
The Linux kernel CVE team issued an advisory for CVE-2023-52800 affecting ath11k HTTP packet-log handling. The advisory identified fixes in kernel versions 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7, and recommended updating to a current stable kernel release.
The vulnerable ath11k packet-log code was introduced in Linux kernel 5.6 by commit d5c65159f289. It accessed RCU-protected active physical-device data without an RCU read-side critical section, creating a potential use-after-free condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52798** is a use-after-free vulnerability in the Linux kernel's `ath11k` Wi-Fi driver, affecting DFS radar-event handling in `drivers/net/wireless/ath/ath11k/wmi.c`. Code invoking `ath11k_mac_get_ar_by_pdev_id()` accessed RCU-protected active physical-device data without an RCU read-side critical section, risking access to data after it had been freed. The flaw was introduced in Linux kernel 5.6. Upstream fixes mark the affected operation as an RCU read-side critical section and are available in kernel versions 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later stable releases. Red Hat rated the issue **Low** severity with a CVSS v3.1 score of 4.4, requiring local access and high privileges; RHEL 8 is fixed through `RHSA-2024:7000`, while RHEL 6 and 7 are unaffected and fixes for certain RHEL 8/9 real-time and RHEL 9 kernels were deferred.
Aug 26, 2026
**CVE-2024-57995** is a moderate-severity use-after-free flaw in the Linux kernel's Qualcomm `ath12k` Wi-Fi driver, affecting `ath12k_mac_assign_vif_to_vdev()`. An `arvif` object created on another radio can be freed by `ath12k_mac_unassign_link_vif()` and subsequently dereferenced. The vulnerability was introduced in Linux 6.10 and fixed upstream in stable kernel 6.13.2 and 6.14-rc1; the Linux kernel CVE team recommends upgrading to a current stable release rather than applying the isolated fix. Red Hat assigned the vulnerability a CVSS v3.1 score of 6.7 and states exploitation requires local root privileges. Fixes are available for RHEL 9 and RHEL 10 through advisories `RHSA-2025:20518` and `RHSA-2025:20095`; RHEL 6, 7, 7 kernel-rt, 8, and 8 kernel-rt are not affected, while RHEL 9 kernel-rt is listed as will not fix.
Aug 26, 2026
**CVE-2024-58015** affects the Linux kernel's `ath12k` Wi-Fi driver, where debugfs handling of self-generated HTTP statistics passed an oversized array-length value to `print_array_to_buf_index()`. The off-by-one buffer bound can trigger an out-of-bounds memory read, potentially exposing local information or affecting system availability. The defect was identified through Coverity findings `CID 1600742` and `CID 1600758`. The upstream fix reduces the buffer size by one and is available in Linux kernel `6.13.3` and `6.14-rc1`; the Linux kernel CVE team recommends updating to a current stable release rather than selectively applying the patch. Red Hat rated the issue Moderate with CVSS 6.0, while NVD assigned 7.1. Red Hat issued fixes for RHEL 9 and RHEL 10 through `RHSA-2025:20518` and `RHSA-2025:20095`; RHEL 9 `kernel-rt` is marked will not fix, and RHEL 6, 7, 8 and their listed real-time kernel variants are not affected.
Aug 26, 2026