The Linux kernel's ath11k WiFi driver contained a vulnerability where the functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() allocated memory for beacon templates but did not free it upon error return, causing memory leaks. This was fixed by implementing unified exit paths with proper cleanup in error handling. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and related builds. The issue was identified through static analysis and code review. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability can lead to memory leaks in the WiFi driver, potentially causing resource exhaustion and denial of service (availability impact). There is no impact on confidentiality or integrity. The attack requires local access with low privileges and no user interaction. No known exploits are reported in the wild.

A patch is available and should be applied by updating the Linux kernel to versions 7.0.0-28.28 or later (and corresponding fixed builds). After updating, a system reboot is required. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow vendor instructions for updating and recompiling kernel modules to fully remediate the issue.