CVE-2026-23135: Linux Kernel ath12k DMA Memory Vulnerability

CVE-2026-23135 Overview

A memory management vulnerability has been identified in the Linux kernel's ath12k WiFi driver. The vulnerability exists in the dma_free_coherent() function where incorrect pointer addresses are used when freeing DMA-mapped buffers. Specifically, the dma_alloc_coherent() function allocates DMA mapped buffers and stores the addresses in XXX_unaligned fields, but when freeing these buffers, the aligned addresses are incorrectly used instead of the original unaligned addresses stored during allocation.

Critical Impact
Improper DMA buffer deallocation in the ath12k WiFi driver may lead to memory corruption, system instability, or potential denial of service conditions on affected Linux systems.

Affected Products

Linux kernel with ath12k WiFi driver enabled
Systems with Qualcomm Atheros 802.11ax (WiFi 6E/7) wireless chipsets
Linux kernel versions prior to the security patches

Discovery Timeline

2026-02-14 - CVE CVE-2026-23135 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23135

Vulnerability Analysis

This vulnerability stems from a programming error in the ath12k wireless driver's DMA memory management routines. When the kernel allocates DMA-coherent memory using dma_alloc_coherent(), the function returns memory that may not be aligned to specific boundaries. The driver stores these original addresses in XXX_unaligned fields for later use. However, during the deallocation process, the code erroneously passes the aligned addresses to dma_free_coherent() rather than the original unaligned addresses that were stored during allocation.

This mismatch between allocation and deallocation addresses violates the DMA API contract, which requires that the exact same virtual address and DMA handle returned by dma_alloc_coherent() be passed to dma_free_coherent(). Using incorrect addresses can result in improper memory release, memory leaks, or corruption of the DMA memory management structures within the kernel.

Root Cause

The root cause is a pointer handling error in the ath12k driver where the developer incorrectly used aligned addresses during buffer deallocation instead of preserving and using the original unaligned addresses that were stored by dma_alloc_coherent(). This violates the fundamental principle that DMA memory must be freed using the same pointer that was originally allocated.

Attack Vector

The attack vector for this vulnerability is currently classified as unknown. Since this is a kernel driver vulnerability affecting DMA memory management, exploitation would likely require:

Local access to a system with the ath12k driver loaded
The ability to trigger repeated allocation and deallocation of DMA buffers through WiFi operations
Potential timing conditions to exploit the memory corruption

While direct remote exploitation is unlikely, a local attacker could potentially leverage this vulnerability to cause system instability or denial of service by triggering the faulty memory deallocation path repeatedly.

Detection Methods for CVE-2026-23135

Indicators of Compromise

Unexpected kernel panics or oops messages referencing the ath12k driver or DMA subsystem
System crashes during WiFi operations on systems with Qualcomm Atheros WiFi 6E/7 hardware
Memory allocation failures logged in kernel messages related to coherent DMA operations
Unexpected behavior or disconnections from WiFi networks on affected systems

Detection Strategies

Monitor kernel logs (dmesg) for errors related to ath12k, DMA operations, or coherent memory allocation failures
Implement kernel crash dump analysis to identify signatures related to DMA pointer corruption
Use kernel debugging tools like KASAN (Kernel Address Sanitizer) to detect memory management violations
Deploy endpoint detection solutions capable of monitoring kernel module behavior

Monitoring Recommendations

Enable kernel logging with appropriate verbosity for the ath12k driver module
Configure crash dump collection (kdump) to capture kernel crash data for post-incident analysis
Monitor system stability metrics on endpoints with affected Qualcomm Atheros WiFi hardware
Implement alerts for repeated kernel module failures or restarts

How to Mitigate CVE-2026-23135

Immediate Actions Required

Apply the latest kernel security patches from your Linux distribution
If patching is not immediately possible, consider disabling the ath12k driver on critical systems
Monitor affected systems for signs of instability while awaiting patch deployment
Review kernel update schedules and prioritize systems with exposed WiFi interfaces

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that the original unaligned addresses stored during dma_alloc_coherent() are properly reused when calling dma_free_coherent().

Patches are available from the following kernel git commits:

Workarounds

Temporarily disable the ath12k driver by blacklisting the kernel module if WiFi functionality is not required
Use alternative WiFi hardware with different drivers until patches are applied
Isolate affected systems from untrusted networks to reduce exposure
Consider using wired Ethernet connections on critical systems until patched

bash

# Temporarily disable ath12k driver by blacklisting the module
echo "blacklist ath12k" | sudo tee /etc/modprobe.d/blacklist-ath12k.conf
sudo update-initramfs -u
# Reboot required for changes to take effect