{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38290", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.001Z", "datePublished": "2025-07-10T07:42:06.259Z", "dateUpdated": "2026-08-05T12:01:00.208Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:00.208Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix node corruption in ar->arvifs list\n\nIn current WLAN recovery code flow, ath12k_core_halt() only reinitializes\nthe \"arvifs\" list head. This will cause the list node immediately following\nthe list head to become an invalid list node. Because the prev of that node\nstill points to the list head \"arvifs\", but the next of the list head\n\"arvifs\" no longer points to that list node.\n\nWhen a WLAN recovery occurs during the execution of a vif removal, and it\nhappens before the spin_lock_bh(&ar->data_lock) in\nath12k_mac_vdev_delete(), list_del() will detect the previously mentioned\nsituation, thereby triggering a kernel panic.\n\nThe fix is to remove and reinitialize all vif list nodes from the list head\n\"arvifs\" during WLAN halt. The reinitialization is to make the list nodes\nvalid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute\nnormally.\n\nCall trace:\n__list_del_entry_valid_or_report+0xd4/0x100 (P)\nath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k]\nath12k_scan_vdev_clean_work+0x40/0x164 [ath12k]\ncfg80211_wiphy_work+0xfc/0x100\nprocess_one_work+0x164/0x2d0\nworker_thread+0x254/0x380\nkthread+0xfc/0x100\nret_from_fork+0x10/0x20\n\nThe change is mostly copied from the ath11k patch:\nhttps://lore.kernel.org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - Both halves of the race are driven over the air on the ath12k Wi-Fi 7 radio — firmware asserts (MHI_CB_EE_RDDM, the sole trigger for `ath12k_core_halt()`) are inducible by malformed/fuzzed 802.11 management frames, and link/vif teardown is driven by deauth/disassoc frames forcing disconnect-and-rescan cycles. No local access is needed, but the attacker must be within radio range, which is Adjacent rather than Network.\nAC:L - The attacker influences both sides of the race — repeatedly forcing firmware asserts while simultaneously forcing scan-link teardown via deauth floods — and the corruption window recurs on every recovery cycle, so no condition is outside attacker control. Per the race-condition guidance, attacker-driven races are Low.\nPR:N - Deauthentication/disassociation and malformed management frames are unauthenticated, pre-association 802.11 traffic (unprotected absent PMF), so no credentials on the target network or any local account are required. The vulnerable `ath12k_core_halt()` path runs entirely inside driver recovery with no capability check.\nUI:N - Firmware recovery, scan-link cleanup (`ath12k_scan_vdev_clean_work`) and connection-loss link teardown all execute automatically from cfg80211/mac80211 workqueues. No victim action is needed beyond having the interface up.\nS:U - The corruption and its consequences are confined to the kernel of the machine running the ath12k driver. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The half-reinitialized list leaves `ar->arvifs` pointing at `ath12k_link_vif` objects that `ath12k_mac_unassign_link_vif()` kfree()s, and later reverse traversal at mac.c:1262 reads through those dangling pointers and dereferences `arvif->ahvif` and `arvif->bssid`. That is a use-after-free read of groomable slab memory, which per the UAF guidance is High.\nI:H - `list_add(&arvif->list, &ar->arvifs)` (mac.c:10311) writes a kernel pointer into `head->next->prev`, i.e. into a freed `ath12k_link_vif` slab object, and `list_del()` on the corrupted node writes through stale prev/next — the classic list-corruption write primitive, exploitable for control-flow hijack after heap spraying.\nA:H - The documented symptom is a kernel panic via `__list_del_entry_valid_or_report` on `CONFIG_DEBUG_LIST`/`CONFIG_BUG_ON_DATA_CORRUPTION` builds; on builds without list debugging the resulting dangling-pointer traversal oopses instead. Either way the system crashes, and the condition is repeatable on every forced recovery." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/core.c" ], "versions": [ { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "be049199dec9189602bc06e2c70eda3aa0f2ea6e", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "6285516170f9e2f04b9dbf1e5100e0d7cbac22b4", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "6bfe7ae9bbd9734751b853e2d2e1c13e8b46fd2d", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "823435bd23108d6f8be89ea2d025c0e2e3769c51", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/core.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.94", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.94" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.15.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/be049199dec9189602bc06e2c70eda3aa0f2ea6e" }, { "url": "https://git.kernel.org/stable/c/6285516170f9e2f04b9dbf1e5100e0d7cbac22b4" }, { "url": "https://git.kernel.org/stable/c/6bfe7ae9bbd9734751b853e2d2e1c13e8b46fd2d" }, { "url": "https://git.kernel.org/stable/c/823435bd23108d6f8be89ea2d025c0e2e3769c51" } ], "title": "wifi: ath12k: fix node corruption in ar->arvifs list", "x_generator": { "engine": "bippy-1.2.0" } } } }