Loading story…
CVE-2023-52798 is a use-after-free vulnerability in the Linux kernel's ath11k Wi-Fi driver, affecting DFS radar-event handling in drivers/net/wireless/ath/ath11k/wmi.c. Code invoking ath11k_mac_get_ar_by_pdev_id() accessed RCU-protected active physical-device data without an RCU read-side critical section, risking access to data after it had been freed. The flaw was introduced in Linux kernel 5.6.
Upstream fixes mark the affected operation as an RCU read-side critical section and are available in kernel versions 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later stable releases. Red Hat rated the issue Low severity with a CVSS v3.1 score of 4.4, requiring local access and high privileges; RHEL 8 is fixed through RHSA-2024:7000, while RHEL 6 and 7 are unaffected and fixes for certain RHEL 8/9 real-time and RHEL 9 kernels were deferred.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:7000 to fix CVE-2023-52798 in the Red Hat Enterprise Linux 8 kernel. Red Hat rated the use-after-free issue Low severity with a CVSS v3.1 score of 4.4; fixes for RHEL 8 kernel-rt and RHEL 9 kernel variants were deferred.
The Linux kernel CVE team published CVE-2023-52798 for the ath11k DFS radar-event locking issue. Fixes were made available in stable kernel versions 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7.
The ath11k DFS radar-event handling flaw was introduced in Linux kernel version 5.6 by commit d5c65159f289. The code accessed RCU-protected active physical-device data without an RCU read-side critical section, creating a potential use-after-free condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52800** is a low-severity use-after-free vulnerability in the Linux kernel's `ath11k` Wi-Fi driver. In HTTP packet-log handling within `drivers/net/wireless/ath/ath11k/dp_rx.c`, code accessed RCU-protected active physical-device data through `ath11k_mac_get_ar_by_pdev_id()` without an RCU read-side critical section. The flaw, introduced in kernel 5.6, requires local access and high privileges; Red Hat assigned CVSS 4.4, citing potential availability impact with no confidentiality or integrity impact. Upstream fixes are available in Linux 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, 6.7, and later stable releases, and maintainers recommend updating to a current stable kernel rather than cherry-picking the patch. Red Hat remediated affected Red Hat Enterprise Linux 8 kernels through **RHSA-2024:7000**; RHEL 6 and 7 were assessed as not affected, while fixes for RHEL 8 `kernel-rt` and RHEL 9 kernel variants were deferred.
Aug 26, 2026
**CVE-2024-57995** is a moderate-severity use-after-free flaw in the Linux kernel's Qualcomm `ath12k` Wi-Fi driver, affecting `ath12k_mac_assign_vif_to_vdev()`. An `arvif` object created on another radio can be freed by `ath12k_mac_unassign_link_vif()` and subsequently dereferenced. The vulnerability was introduced in Linux 6.10 and fixed upstream in stable kernel 6.13.2 and 6.14-rc1; the Linux kernel CVE team recommends upgrading to a current stable release rather than applying the isolated fix. Red Hat assigned the vulnerability a CVSS v3.1 score of 6.7 and states exploitation requires local root privileges. Fixes are available for RHEL 9 and RHEL 10 through advisories `RHSA-2025:20518` and `RHSA-2025:20095`; RHEL 6, 7, 7 kernel-rt, 8, and 8 kernel-rt are not affected, while RHEL 9 kernel-rt is listed as will not fix.
Aug 26, 2026
**CVE-2024-58015** affects the Linux kernel's `ath12k` Wi-Fi driver, where debugfs handling of self-generated HTTP statistics passed an oversized array-length value to `print_array_to_buf_index()`. The off-by-one buffer bound can trigger an out-of-bounds memory read, potentially exposing local information or affecting system availability. The defect was identified through Coverity findings `CID 1600742` and `CID 1600758`. The upstream fix reduces the buffer size by one and is available in Linux kernel `6.13.3` and `6.14-rc1`; the Linux kernel CVE team recommends updating to a current stable release rather than selectively applying the patch. Red Hat rated the issue Moderate with CVSS 6.0, while NVD assigned 7.1. Red Hat issued fixes for RHEL 9 and RHEL 10 through `RHSA-2025:20518` and `RHSA-2025:20095`; RHEL 9 `kernel-rt` is marked will not fix, and RHEL 6, 7, 8 and their listed real-time kernel variants are not affected.
Aug 26, 2026