CVE-2023-53764
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-53764
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53764.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-53764
- Downstream
- Published
- 2025-12-08T01:19:26.619Z
- Modified
- 2025-12-08T03:56:39.480965Z
- Summary
- wifi: ath12k: Handle lock during peer_id find
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Handle lock during peer_id find
ath12kpeerfindbyid() requires that the caller hold the ab->baselock. Currently the WBM error path does not hold the lock and calling that function, leads to the following lockdepassert()in QCN9274:
[105162.160893] ------------[ cut here ]------------ [105162.160916] WARNING: CPU: 3 PID: 0 at drivers/net/wireless/ath/ath12k/peer.c:71 ath12kpeerfindbyid+0x52/0x60 [ath12k] [105162.160933] Modules linked in: ath12k(O) qrtrmhi qrtr mac80211 cfg80211 mhi qmihelpers libarc4 nvme nvmecore [last unloaded: ath12k(O)] [105162.160967] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G W O 6.1.0-rc2+ #3 [105162.160972] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0056.2019.0506.1527 05/06/2019 [105162.160977] RIP: 0010:ath12kpeerfindbyid+0x52/0x60 [ath12k] [105162.160990] Code: 07 eb 0f 39 68 24 74 0a 48 8b 00 48 39 f8 75 f3 31 c0 5b 5d c3 48 8d bf b0 f2 00 00 be ff ff ff ff e8 22 20 c4 e2 85 c0 75 bf <0f> 0b eb bb 66 2e 0f 1f 84 00 00 00 00 00 41 54 4c 8d a7 98 f2 00 [105162.160996] RSP: 0018:ffffa223001acc60 EFLAGS: 00010246 [105162.161003] RAX: 0000000000000000 RBX: ffff9f0573940000 RCX: 0000000000000000 [105162.161008] RDX: 0000000000000001 RSI: ffffffffa3951c8e RDI: ffffffffa39a96d7 [105162.161013] RBP: 000000000000000a R08: 0000000000000000 R09: 0000000000000000 [105162.161017] R10: ffffa223001acb40 R11: ffffffffa3d57c60 R12: ffff9f057394f2e0 [105162.161022] R13: ffff9f0573940000 R14: ffff9f04ecd659c0 R15: ffff9f04d5a9b040 [105162.161026] FS: 0000000000000000(0000) GS:ffff9f0575600000(0000) knlGS:0000000000000000 [105162.161031] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105162.161036] CR2: 00001d5c8277a008 CR3: 00000001e6224006 CR4: 00000000003706e0 [105162.161041] Call Trace: [105162.161046] <IRQ> [105162.161051] ath12kdprxprocesswbmerr+0x6da/0xaf0 [ath12k] [105162.161072] ? ath12kdprxprocesserr+0x80e/0x15a0 [ath12k] [105162.161084] ? _lockacquire+0x4ca/0x1a60 [105162.161104] ath12kdpservicesrng+0x263/0x310 [ath12k] [105162.161120] ath12kpciextgrpnapipoll+0x1c/0x70 [ath12k] [105162.161133] _napipoll+0x22/0x260 [105162.161141] netrxaction+0x2f8/0x380 [105162.161153] _dosoftirq+0xd0/0x4c9 [105162.161162] irqexitrcu+0x88/0xe0 [105162.161169] commoninterrupt+0xa5/0xc0 [105162.161174] </IRQ> [105162.161179] <TASK> [105162.161184] asmcommon_interrupt+0x22/0x40
Handle spin lock/unlock in WBM error path to hold the necessary lock expected by ath12kpeerfindbyid().
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-03171-QCAHKSWPL_SILICONZ-1
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53764.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/95a389e2ff3212d866cc51c77d682d2934074eb8
- https://git.kernel.org/stable/c/9faf7c696610a348ca94a224d55c946b19b3279d
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53764.json
- https://nvd.nist.gov/vuln/detail/CVE-2023-53764
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed9faf7c696610a348ca94a224d55c946b19b3279dFixed95a389e2ff3212d866cc51c77d682d2934074eb8