Linux kernel (ath11k) vulnerabilities

A memory leak was found in the Linux kernel's ath11k Wi-Fi driver. When the firmware crashes, ath11k_mac_peer_cleanup_all() failed to free arsta->rx_stats and tx_stats resources, causing kernel memory leaks (kmemleak). The fix extracts arsta cleanup into a new ath11k_mac_station_cleanup() function and calls it from both locations.

In the Linux kernel, the ath11k Wi-Fi driver does not enforce a minimum length for the WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT structure, and the firmware-supplied num_vdevs field is used as a loop bound without validation. This can cause an out-of-bounds read. The fix adds a TLV policy entry and a helper to bound num_vdevs.

In the Linux kernel, the ath11k driver for Qualcomm Wi-Fi cards has a vulnerability causing a system crash during 'rmmod ath11k_pci' when amss.bin is missing. The issue is due to using mhi_async_power_up(), which does not check errors, instead of the safer mhi_sync_power_up().