CVE-2024-50236 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2024-50236?

CVE-2024-50236 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's ath10k WiFi driver. When management packets are transmitted, memory allocated for MSDU contexts is not properly freed during completion or cleanup, leading to gradual memory exhaustion. This affects Linux systems using ath10k-based WiFi hardware, particularly Qualcomm WCN3990 chipsets.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's ath10k WiFi driver. When management packets are transmitted, memory allocated for MSDU contexts is not properly freed during completion or cleanup, leading to gradual memory exhaustion. This affects Linux systems using ath10k-based WiFi hardware, particularly Qualcomm WCN3990 chipsets.

💻 Affected Systems

Products:

Linux kernel with ath10k driver

Versions: Specific kernel versions containing vulnerable ath10k code (exact range depends on distribution backports)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with ath10k-based WiFi hardware (particularly Qualcomm WCN3990). Systems without this hardware or with WiFi disabled are not vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could cause kernel memory exhaustion, leading to system instability, crashes, or denial of service requiring physical reboot.

🟠

Likely Case

Gradual memory consumption over time causing performance degradation, WiFi connectivity issues, or eventual system instability requiring restart.

🟢

If Mitigated

With proper patching, no impact beyond normal system operation.

🌐 Internet-Facing: LOW - Requires local access to trigger management packet transmission, not directly exploitable over internet.

🏢 Internal Only: MEDIUM - Local attackers or malicious processes could trigger the leak, but requires WiFi hardware and driver usage.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to trigger management packet transmission through the ath10k driver, typically requiring local access or WiFi client capabilities.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel commits: 2f6f1e26ac6d2b38e2198a71f81f0ade14d6b07b, 4112450da7d67b59ccedc2208bae622db17dbcb8, 5f5a939759c79e7385946c85e62feca51a18d816, 6cc23898e6ba47e976050d3c080b4d2c1add3748, 6fc9af3df6ca7f3c94774d20f62dc7b49616026d

Vendor Advisory: https://git.kernel.org/stable/c/2f6f1e26ac6d2b38e2198a71f81f0ade14d6b07b

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing fixes. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable ath10k WiFi

linux

Disable the vulnerable ath10k driver if WiFi functionality is not required

sudo modprobe -r ath10k_core
sudo modprobe -r ath10k_pci
echo 'blacklist ath10k_core' | sudo tee /etc/modprobe.d/blacklist-ath10k.conf
echo 'blacklist ath10k_pci' | sudo tee -a /etc/modprobe.d/blacklist-ath10k.conf

🧯 If You Can't Patch

Monitor system memory usage for unusual growth patterns
Implement regular system reboots to clear accumulated memory leaks

🔍 How to Verify

Check if Vulnerable:

Check if ath10k driver is loaded: lsmod | grep ath10k. If loaded and kernel version is vulnerable, system is affected.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes fix commits or verify via distribution security updates. Monitor for memory leaks after fix.

📡 Detection & Monitoring

Log Indicators:

Kernel oom-killer messages
System memory exhaustion warnings
dmesg showing memory allocation failures

Network Indicators:

Unusual WiFi management packet patterns if monitoring is available

SIEM Query:

source="kernel" AND ("out of memory" OR "oom-killer" OR "ath10k")

📊 Metadata

CVE ID: CVE-2024-50236

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

Published: November 9, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-50236, you might also want to check these: