In the Linux kernel, a flaw in the ath12k wireless driver caused a NULL pointer dereference when the driver was unbound and its internal hash tables were destroyed. The hash tables are allocated late during initialization, so if the driver never fully starts or if initialization fails, their pointers remain NULL. Unconditionally calling the destroy routine in cleanup paths triggers a kernel crash. This results in a denial of service because the system hangs or requires a reboot. The weakness is a standard NULL pointer dereference. The vulnerability is limited to kernel code that includes the ath12k driver; it does not provide a direct path to arbitrary code execution. Affected systems: The vulnerability exists in any Linux kernel that uses the ath12k driver before the patch was applied. Vendors listed are Linux:Linux. The affected versions are all kernels lacking the NULL check in both ath12k_link_sta and ath12k_dp_link_peer destroy functions, i.e., kernels prior to the commit that introduced the check. Risk and exploitability: The flaw results in a kernel crash under a cleanup path that is triggered upon driver removal. The attack vector is local, requiring the ability to unload or rebind the ath12k driver, which typically requires elevated privileges on the host. The exploitability is therefore limited to systems where a malicious user can influence driver state or to situations where a device driver is improperly cleaned up during normal operation. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not supplied, but the impact suggests a medium-level severity bounded to denial of service and local privilege escalation possibilities only if an attacker can gain the required privileges.

Linux kernels deploying the ath12k wireless driver, before the patch that added NULL checks to rhashtable_destroy calls. All distributions using the kernel’s ath12k module are potentially impacted until updated to a version containing the fix.

Although the flaw causes a kernel crash leading to denial of service, it does not provide direct remote code execution. Attackers would need local access to unload the driver or exploit a fault where the device is not fully initialized. Given the lack of EPSS data and no KEV listing, the likelihood of widespread exploitation is low, but care should be taken on systems that may erroneously remove the driver or run vulnerable kernel versions.