A flaw in the ath12k Wi‑Fi driver causes a memory leak when the TKIP integrity check encounters an invalid NWIFI header length. The driver aborts the verification, clears the fragment pointer, and then fails to free the associated MSDU. The leak is confined to the kernel driver’s memory arena and can grow unbounded if the error path is triggered repeatedly. The vulnerability does not provide code execution or privilege escalation, but sustained resource exhaustion could lead to a local denial‑of‑service.

Any Linux kernel that contains the ath12k driver before the inclusion of commit 5187a9209 or 98d4f92ab6 is affected. Devices such as the WCN7850 PCI WLAN adapter running an unpatched kernel are examples of impacted systems.

The EPSS score is under 1% and the issue is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. With a CVSS score of 5.5 the vulnerability is considered a moderate availability risk. The attack vector is inferred to be an attacker sending malformed TKIP Wi‑Fi frames to the system; this is not explicitly stated in the advisory but is a plausible trigger based on the driver’s logic.