GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52776 (GCVE-0-2023-52776)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:30 – Updated: 2026-08-05 09:11
VLAI
Title
wifi: ath12k: fix dfs-radar and temperature event locking
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dfs-radar and temperature event locking The ath12k active pdevs are protected by RCU but the DFS-radar and temperature event handling code calling ath12k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as RCU read-side critical sections to avoid any potential use-after-free issues. Note that the temperature event handler looks like a place holder currently but would still trigger an RCU lockdep splat. Compile tested only.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-29 18:48 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 774de37c147fea81f2c2e4be5082304f4f71d535 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < d7a5f7f76568e48869916d769e28b9f3ca70c78e (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 69bd216e049349886405b1c87a55dce3d35d1ba7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.5.13 , ≤ 6.5.* (semver)
Unaffected: 6.6.3 , ≤ 6.6.* (semver)
Unaffected: 6.7 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52776",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T18:48:38.223706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-31T14:25:28.524Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.862Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "774de37c147fea81f2c2e4be5082304f4f71d535",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "d7a5f7f76568e48869916d769e28b9f3ca70c78e",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "69bd216e049349886405b1c87a55dce3d35d1ba7",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.13",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix dfs-radar and temperature event locking\n\nThe ath12k active pdevs are protected by RCU but the DFS-radar and\ntemperature event handling code calling ath12k_mac_get_ar_by_pdev_id()\nwas not marked as a read-side critical section.\n\nMark the code in question as RCU read-side critical sections to avoid\nany potential use-after-free issues.\n\nNote that the temperature event handler looks like a place holder\ncurrently but would still trigger an RCU lockdep splat.\n\nCompile tested only."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path runs when ath12k firmware delivers WMI_PDEV_DFS_RADAR_DETECTION_EVENTID over CE/HTC into ath12k_wmi_pdev_dfs_radar_detected_event; an attacker must be in RF range to inject radar-like pulses against a DFS AP, matching Adjacent for Wi\u2011Fi/RF attacks.\nAC:L - An adjacent attacker can repeatedly spoof radar to fire the event handler at will, and the resulting DFS CAC cancel/channel leave/reconfigure races with further in-flight WMI events against pdevs_active, so the attacker influences both sides of the missing-RCU race.\nPR:N - Radar pulses are processed entirely in the firmware-to-host WMI softirq path with no host account, capability, or authentication check; the worst reasonable case is an unauthenticated peer near an ath12k AP on a 5 GHz DFS channel.\nUI:N - Once the radio is up with DFS phyerr offload enabled, firmware radar indications are handled automatically with no victim action such as mounting a device or opening a file.\nS:U - The potential use-after-free corrupts ath12k/mac80211 state inside the host kernel authority only and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Missing rcu_read_lock around ath12k_mac_get_ar_by_pdev_id() allows use of RCU-protected pdev/ar state after deactivation/teardown; that UAF enables heap reuse and arbitrary kernel disclosure.\nI:H - The same UAF of sprayable ath12k/ieee80211 state while the handler still calls ieee80211_radar_detected(ar-\u003ehw) yields write and control-flow primitives characteristic of exploitable kernel UAFs.\nA:H - Concurrent use of a deactivated or freed ar/hw after synchronize_rcu without a matching read-side critical section can oops/panic the kernel, so availability impact is complete even without full code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:23.511Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e"
        },
        {
          "url": "https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7"
        }
      ],
      "title": "wifi: ath12k: fix dfs-radar and temperature event locking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52776",
    "datePublished": "2024-05-21T15:30:56.906Z",
    "dateReserved": "2024-05-21T15:19:24.239Z",
    "dateUpdated": "2026-08-05T09:11:23.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52776",
      "date": "2026-09-15",
      "epss": "0.00849",
      "percentile": "0.56203"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: fix dfs-radar and temperature event locking\\n\\nThe ath12k active pdevs are protected by RCU but the DFS-radar and\\ntemperature event handling code calling ath12k_mac_get_ar_by_pdev_id()\\nwas not marked as a read-side critical section.\\n\\nMark the code in question as RCU read-side critical sections to avoid\\nany potential use-after-free issues.\\n\\nNote that the temperature event handler looks like a place holder\\ncurrently but would still trigger an RCU lockdep splat.\\n\\nCompile tested only.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: corrige el bloqueo de eventos de temperatura y radar dfs. Los pdev activos de ath12k est\\u00e1n protegidos por RCU, pero el c\\u00f3digo de manejo de eventos de temperatura y radar DFS que llama a ath12k_mac_get_ar_by_pdev_id() no estaba marcado como una secci\\u00f3n cr\\u00edtica del lado de lectura. Marque el c\\u00f3digo en cuesti\\u00f3n como secciones cr\\u00edticas del lado de lectura de RCU para evitar posibles problemas de use after free. Tenga en cuenta que el controlador de eventos de temperatura actualmente parece un marcador de posici\\u00f3n, pero a\\u00fan as\\u00ed activar\\u00eda un bloqueo de bloqueo de RCU. Compilaci\\u00f3n probada \\u00fanicamente.\"}]",
      "id": "CVE-2023-52776",
      "lastModified": "2024-11-21T08:40:33.883",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.6}]}",
      "published": "2024-05-21T16:15:16.680",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52776\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:16.680\",\"lastModified\":\"2026-08-04T10:18:41.360\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: fix dfs-radar and temperature event locking\\n\\nThe ath12k active pdevs are protected by RCU but the DFS-radar and\\ntemperature event handling code calling ath12k_mac_get_ar_by_pdev_id()\\nwas not marked as a read-side critical section.\\n\\nMark the code in question as RCU read-side critical sections to avoid\\nany potential use-after-free issues.\\n\\nNote that the temperature event handler looks like a place holder\\ncurrently but would still trigger an RCU lockdep splat.\\n\\nCompile tested only.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: corrige el bloqueo de eventos de temperatura y radar dfs. Los pdev activos de ath12k est\u00e1n protegidos por RCU, pero el c\u00f3digo de manejo de eventos de temperatura y radar DFS que llama a ath12k_mac_get_ar_by_pdev_id() no estaba marcado como una secci\u00f3n cr\u00edtica del lado de lectura. Marque el c\u00f3digo en cuesti\u00f3n como secciones cr\u00edticas del lado de lectura de RCU para evitar posibles problemas de use after free. Tenga en cuenta que el controlador de eventos de temperatura actualmente parece un marcador de posici\u00f3n, pero a\u00fan as\u00ed activar\u00eda un bloqueo de bloqueo de RCU. Compilaci\u00f3n probada \u00fanicamente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/wmi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"774de37c147fea81f2c2e4be5082304f4f71d535\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"d7a5f7f76568e48869916d769e28b9f3ca70c78e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"69bd216e049349886405b1c87a55dce3d35d1ba7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/wmi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.13\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.3\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-29T18:48:38.223706Z\",\"id\":\"CVE-2023-52776\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.5.13\",\"matchCriteriaId\":\"81D6709B-8CD5-4054-8AC5-D8C32228FA43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.3\",\"matchCriteriaId\":\"B58252FA-A49C-411F-9B28-DC5FE44BC5A0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:43:38+00:00",
      "cve": "CVE-2023-52776",
      "id": "CVE-2023-52776",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath12k: fix dfs-radar and temperature event locking",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52776.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:48:04Z",
      "cve": "CVE-2023-52776",
      "id": "CVE-2023-52776",
      "initial_release_date": "2024-05-23T15:24:01Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "354",
      "product_status:recommended": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52776",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52776.json",
      "version": "68"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:35.862Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52776\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-29T18:48:38.223706Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-29T18:48:41.764Z\"}}], \"cna\": {\"title\": \"wifi: ath12k: fix dfs-radar and temperature event locking\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerable path runs when ath12k firmware delivers WMI_PDEV_DFS_RADAR_DETECTION_EVENTID over CE/HTC into ath12k_wmi_pdev_dfs_radar_detected_event; an attacker must be in RF range to inject radar-like pulses against a DFS AP, matching Adjacent for Wi\\u2011Fi/RF attacks.\\nAC:L - An adjacent attacker can repeatedly spoof radar to fire the event handler at will, and the resulting DFS CAC cancel/channel leave/reconfigure races with further in-flight WMI events against pdevs_active, so the attacker influences both sides of the missing-RCU race.\\nPR:N - Radar pulses are processed entirely in the firmware-to-host WMI softirq path with no host account, capability, or authentication check; the worst reasonable case is an unauthenticated peer near an ath12k AP on a 5 GHz DFS channel.\\nUI:N - Once the radio is up with DFS phyerr offload enabled, firmware radar indications are handled automatically with no victim action such as mounting a device or opening a file.\\nS:U - The potential use-after-free corrupts ath12k/mac80211 state inside the host kernel authority only and does not cross a VM, IOMMU, or sandbox boundary.\\nC:H - Missing rcu_read_lock around ath12k_mac_get_ar_by_pdev_id() allows use of RCU-protected pdev/ar state after deactivation/teardown; that UAF enables heap reuse and arbitrary kernel disclosure.\\nI:H - The same UAF of sprayable ath12k/ieee80211 state while the handler still calls ieee80211_radar_detected(ar-\u003ehw) yields write and control-flow primitives characteristic of exploitable kernel UAFs.\\nA:H - Concurrent use of a deactivated or freed ar/hw after synchronize_rcu without a matching read-side critical section can oops/panic the kernel, so availability impact is complete even without full code execution.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"774de37c147fea81f2c2e4be5082304f4f71d535\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"d7a5f7f76568e48869916d769e28b9f3ca70c78e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"69bd216e049349886405b1c87a55dce3d35d1ba7\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/wmi.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.5.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.5.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/wmi.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/774de37c147fea81f2c2e4be5082304f4f71d535\"}, {\"url\": \"https://git.kernel.org/stable/c/d7a5f7f76568e48869916d769e28b9f3ca70c78e\"}, {\"url\": \"https://git.kernel.org/stable/c/69bd216e049349886405b1c87a55dce3d35d1ba7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: fix dfs-radar and temperature event locking\\n\\nThe ath12k active pdevs are protected by RCU but the DFS-radar and\\ntemperature event handling code calling ath12k_mac_get_ar_by_pdev_id()\\nwas not marked as a read-side critical section.\\n\\nMark the code in question as RCU read-side critical sections to avoid\\nany potential use-after-free issues.\\n\\nNote that the temperature event handler looks like a place holder\\ncurrently but would still trigger an RCU lockdep splat.\\n\\nCompile tested only.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.5.13\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.3\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:11:23.511Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52776\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:11:23.511Z\", \"dateReserved\": \"2024-05-21T15:19:24.239Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:30:56.906Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.