CVE-2026-23135: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23135 is a denial-of-service vulnerability in the Linux kernel's ath12k WiFi driver caused by incorrect DMA pointer handling during buffer deallocation. The dma_alloc_coherent() function stores allocated buffer addresses in _unaligned fields, but the driver incorrectly passes aligned addresses to dma_free_coherent() instead of the original unaligned pointers. Affected Linux kernel versions include 6.3 through 6.6.121, 6.7 through 6.12.67, 6.13 through 6.18.7, and 6.19-rc1 through 6.19-rc6. It was published on February 14, 2026, with patches released on March 17, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Feedly).

The root cause is improper memory management (CWE-119/incorrect pointer use) in the ath12k WiFi driver within the Linux kernel. When dma_alloc_coherent() allocates a DMA-mapped buffer, it returns both an aligned address (used for data access) and an unaligned address (stored in XXX_unaligned fields, required for correct deallocation). The driver erroneously passes the aligned address to dma_free_coherent(), which can result in freeing an incorrect memory region, leading to memory corruption or kernel instability. Exploitation requires local access with low privileges and no user interaction (Feedly, Kernel Patch 1).

Successful exploitation allows a local, low-privileged attacker to trigger a denial-of-service condition, causing system instability or a kernel crash due to improper DMA buffer deallocation in the ath12k WiFi driver. There is no confidentiality or integrity impact; the vulnerability is limited to availability (rated HIGH for availability impact). In multi-user environments, this represents a practical threat where an unprivileged user could crash the system, disrupting all services running on the affected host (Feedly).

• Logs: Unexpected kernel oops, BUG, or panic messages in /var/log/kern.log or dmesg output referencing ath12k or DMA-related errors.
• Process/System Behavior: Sudden system reboots or kernel crashes on systems with Qualcomm ath12k WiFi hardware; kernel warnings about invalid DMA address frees.
• File System: Kernel crash dump files (e.g., /var/crash/) generated unexpectedly on systems with ath12k driver loaded.

Patches have been released across four kernel stable commits: 24585a13c41e, 36e0bc5e8b28, 4846b32be324, and bb97131fbf9b. Administrators should update to Linux kernel version 6.6.122 or later, 6.12.68 or later, or 6.18.8 or later, depending on the branch in use. If immediate patching is not feasible, restrict local user access on systems running vulnerable kernel versions with ath12k WiFi drivers, particularly in multi-user environments, and monitor system logs for unexpected kernel warnings or crashes (Feedly, Kernel Patch 1).

The vulnerability has been picked up by standard Linux security tracking resources including Tenable (Nessus plugins 299179 and 318847), Qualys, and several Linux security news outlets such as pro-linux.de and linuxsecurity.com, reflecting routine coverage of kernel CVEs. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries (Feedly).