{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38291", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.001Z", "datePublished": "2025-07-10T07:42:06.899Z", "dateUpdated": "2026-08-05T12:01:01.265Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:01.265Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Prevent sending WMI commands to firmware during firmware crash\n\nCurrently, we encounter the following kernel call trace when a firmware\ncrash occurs. This happens because the host sends WMI commands to the\nfirmware while it is in recovery, causing the commands to fail and\nresulting in the kernel call trace.\n\nSet the ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags when the\nhost driver receives the firmware crash notification from MHI. This\nprevents sending WMI commands to the firmware during recovery.\n\nCall Trace:\n \n dump_stack_lvl+0x75/0xc0\n register_lock_class+0x6be/0x7a0\n ? __lock_acquire+0x644/0x19a0\n __lock_acquire+0x95/0x19a0\n lock_acquire+0x265/0x310\n ? ath12k_ce_send+0xa2/0x210 [ath12k]\n ? find_held_lock+0x34/0xa0\n ? ath12k_ce_send+0x56/0x210 [ath12k]\n _raw_spin_lock_bh+0x33/0x70\n ? ath12k_ce_send+0xa2/0x210 [ath12k]\n ath12k_ce_send+0xa2/0x210 [ath12k]\n ath12k_htc_send+0x178/0x390 [ath12k]\n ath12k_wmi_cmd_send_nowait+0x76/0xa0 [ath12k]\n ath12k_wmi_cmd_send+0x62/0x190 [ath12k]\n ath12k_wmi_pdev_bss_chan_info_request+0x62/0xc0 [ath1\n ath12k_mac_op_get_survey+0x2be/0x310 [ath12k]\n ieee80211_dump_survey+0x99/0x240 [mac80211]\n nl80211_dump_survey+0xe7/0x470 [cfg80211]\n ? kmalloc_reserve+0x59/0xf0\n genl_dumpit+0x24/0x70\n netlink_dump+0x177/0x360\n __netlink_dump_start+0x206/0x280\n genl_family_rcv_msg_dumpit.isra.22+0x8a/0xe0\n ? genl_family_rcv_msg_attrs_parse.isra.23+0xe0/0xe0\n ? genl_op_lock.part.12+0x10/0x10\n ? genl_dumpit+0x70/0x70\n genl_rcv_msg+0x1d0/0x290\n ? nl80211_del_station+0x330/0x330 [cfg80211]\n ? genl_get_cmd_both+0x50/0x50\n netlink_rcv_skb+0x4f/0x100\n genl_rcv+0x1f/0x30\n netlink_unicast+0x1b6/0x260\n netlink_sendmsg+0x31a/0x450\n __sock_sendmsg+0xa8/0xb0\n ____sys_sendmsg+0x1e4/0x260\n ___sys_sendmsg+0x89/0xe0\n ? local_clock_noinstr+0xb/0xc0\n ? rcu_is_watching+0xd/0x40\n ? kfree+0x1de/0x370\n ? __sys_sendmsg+0x7a/0xc0\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The bug is in the ath12k Wi-Fi driver's firmware-crash handling, and the trigger precondition — a firmware crash reported via MHI_CB_EE_RDDM — is inducible over the air by an unauthenticated attacker within radio range sending malformed 802.11 frames to a QCN9274/WCN7850 radio. The racing WMI traffic is generated automatically by hostapd/wpa_supplicant survey and station-stats polling, so no local access is needed.\nAC:L - The commit states the call trace occurs whenever a firmware crash happens, so the unguarded window is entered deterministically, and the window is wide (it spans ath12k_coredump_collect() plus the whole reset/power-down/QMI cycle). The attacker can repeat the crash and, if local, can also drive the netlink survey-dump side of the race in a tight loop, controlling both sides.\nPR:N - An adjacent attacker needs no credentials on the target to crash the firmware, and the concurrent WMI command path is driven by the system's own daemons polling nl80211 survey/station statistics. Even in the purely local framing, NL80211_CMD_GET_SURVEY carries no GENL_ADMIN_PERM flag, so any unprivileged user can reach ath12k_mac_op_get_survey().\nUI:N - No victim action is required; hostapd/NetworkManager poll survey and station statistics on a timer, and the firmware-crash recovery path runs automatically from workqueue context.\nS:U - The corruption and the crash are confined to the kernel's own memory and the ath12k device state, with no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - ath12k_hal_srng_access_begin() reads through srng->u.src_ring.tp_addr, which points into the DMA-coherent buffer already released by ath12k_hal_free_cont_rdp(); this use-after-free read of recycled memory, together with the torn-down srng/HAL state, is treated as a high confidentiality impact.\nI:H - ath12k_hal_srng_access_end() writes through srng->u.src_ring.hp_addr into the freed hal->wrp coherent buffer, and ath12k_ce_send() writes descriptors and pipe->src_ring->skb[] entries against srng state being concurrently memset by ath12k_hal_srng_init(), giving a use-after-free write into memory that can be reallocated to another consumer.\nA:H - Once ath12k_hal_srng_init() zeroes ab->hal, tp_addr/ring_base_vaddr become NULL and the dereference in ath12k_hal_srng_access_begin() oopses; the reported lockdep \"non-static key\" splat also disables the locking validator, and the WMI waits stall the Wi-Fi interface during recovery." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/mhi.c" ], "versions": [ { "version": "a9b46dd2e483bf99fa09e6aeea7701960abaa902", "lessThan": "2563069baf243cadc76dc64d9085606742c4b282", "status": "affected", "versionType": "git" }, { "version": "a9b46dd2e483bf99fa09e6aeea7701960abaa902", "lessThan": "e9e094a9734ea3bd4d4d117c915ccf129ac61ba1", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/mhi.c" ], "versions": [ { "version": "6.13", "status": "affected" }, { "version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.15.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2563069baf243cadc76dc64d9085606742c4b282" }, { "url": "https://git.kernel.org/stable/c/e9e094a9734ea3bd4d4d117c915ccf129ac61ba1" } ], "title": "wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash", "x_generator": { "engine": "bippy-1.2.0" } } } }