CVE-2024-58096

Source
https://cve.org/CVERecord?id=CVE-2024-58096
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-58096.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-58096
Downstream
Related
Published
2025-04-16T14:11:44.587Z
Modified
2026-03-11T07:52:51.285130Z
Summary
wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: add srng->lock for ath11khalsrng_* in monitor mode

ath11khalsrng_* should be used with srng->lock to protect srng data.

For ath11kdprxmondestprocess() and ath11kdpfullmonprocessrx(), they use ath11khalsrng_* for many times but never call srng->lock.

So when running (full) monitor mode, warning will occur: RIP: 0010:ath11khalsrngdstpeek+0x18/0x30 [ath11k] Call Trace: ? ath11khalsrngdstpeek+0x18/0x30 [ath11k] ath11kdprxprocessmonstatus+0xc45/0x1190 [ath11k] ? idrallocu32+0x97/0xd0 ath11kdprxprocessmonrings+0x32a/0x550 [ath11k] ath11kdpservicesrng+0x289/0x5a0 [ath11k] ath11kpcicextgrpnapipoll+0x30/0xd0 [ath11k] __napipoll+0x30/0x1f0 netrx_action+0x198/0x320 _dosoftirq+0xdd/0x319

So add srng->lock for them to avoid such warnings.

Inorder to fetch the srng->lock, should change srng's definition from 'void' to 'struct halsrng'. And initialize them elsewhere to prevent one line of code from being too long. This is consistent with other ring process functions, such as ath11kdpprocessrx().

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPLV1V2SILICONZLITE-3.6510.30 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58096.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d5c65159f2895379e11ca13f62feabe93278985d
Fixed
27ca8004ba93a0665faa6d477eaeb551e03de6c8
Fixed
1d2178918efc928e11bed9631469ef79ff0a862a
Fixed
b85758e76b6452740fc2a08ced6759af64c0d59a
Fixed
63b7af49496d0e32f7a748b6af3361ec138b1bd3

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-58096.json"