{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37943", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.972Z", "datePublished": "2025-05-20T15:58:19.607Z", "dateUpdated": "2026-08-05T11:58:31.647Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:31.647Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi\n\nIn certain cases, hardware might provide packets with a\nlength greater than the maximum native Wi-Fi header length.\nThis can lead to accessing and modifying fields in the header\nwithin the ath12k_dp_rx_h_undecap_nwifi function for\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type and\npotentially resulting in invalid data access and memory corruption.\n\nAdd a sanity check before processing the SKB to prevent invalid\ndata access in the undecap native Wi-Fi function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable code is the ath12k 802.11 receive path, triggered by a crafted 4-address QoS data frame with the Order bit set that is injected over the air; the attacker must be within Wi-Fi radio range of the target radio. Per kernel guidance, WiFi frame injection is Adjacent.\nAC:L - The attacker fully controls the frame_control field and header contents of the injected frame and can retransmit indefinitely until it lands in the native-Wi-Fi decap or WBM error path; no condition outside the attacker's control is required, and the ath11k twin fix documents real observed stack corruption from this exact path.\nPR:N - No authentication or association is needed — the frame only has to pass the hardware address filter, and the patched null_q_desc/tkip_mic_err error paths specifically handle frames with no peer and no REO queue (ath12k_dp_rx_h_mpdu falls back to HAL_ENCRYPT_TYPE_OPEN when peer lookup fails).\nUI:N - The corruption happens in the NAPI receive path as soon as the frame is processed; no victim action is required beyond having the wireless interface up.\nS:U - The out-of-bounds write corrupts the kernel stack of the receiving host, staying within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The trailing memcpy reads up to 36 bytes from the 30-byte stack array and copies the result into the skb that is delivered to mac80211 (and forwarded in AP/mesh mode), leaking adjacent kernel stack and stale DMA buffer contents; the attacker-controlled stack corruption is further leverageable as a memory-disclosure primitive.\nI:H - Up to 6 bytes of attacker-chosen 802.11 header data are written past a 30-byte stack buffer, overwriting adjacent locals, the stack canary, or saved registers — an out-of-bounds write with controlled content that is a control-flow-hijack primitive.\nA:H - Kernel stack corruption reliably produces a panic via __stack_chk_fail or FORTIFY_SOURCE, and the mishandled skb_pull/skb_push can trigger skb_under_panic; the ath11k report confirms an observed \"Kernel stack is corrupted\" crash." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/dp_rx.c" ], "versions": [ { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "3abe15e756481c45f6acba3d476cb3ca4afc3b61", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "6ee653194ddb83674913fd2727b8ecfae0597ade", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "50be1fb76556e80af9f5da80f28168b6c71bce58", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "9a0dddfb30f120db3851627935851d262e4e7acb", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/dp_rx.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.88", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.24", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.12", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.3", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.88" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.13.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.14.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c" }, { "url": "https://git.kernel.org/stable/c/3abe15e756481c45f6acba3d476cb3ca4afc3b61" }, { "url": "https://git.kernel.org/stable/c/6ee653194ddb83674913fd2727b8ecfae0597ade" }, { "url": "https://git.kernel.org/stable/c/50be1fb76556e80af9f5da80f28168b6c71bce58" }, { "url": "https://git.kernel.org/stable/c/9a0dddfb30f120db3851627935851d262e4e7acb" } ], "title": "wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi", "x_generator": { "engine": "bippy-1.2.0" } } } }