{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37944", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.972Z", "datePublished": "2025-05-20T15:58:20.211Z", "dateUpdated": "2026-08-05T11:58:32.727Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:32.727Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process\n\nCurrently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry\nto fetch the next entry from the destination ring. This is incorrect because\nath12k_hal_srng_src_get_next_entry is intended for source rings, not destination\nrings. This leads to invalid entry fetches, causing potential data corruption or\ncrashes due to accessing incorrect memory locations. This happens because the\nsource ring and destination ring have different handling mechanisms and using\nthe wrong function results in incorrect pointer arithmetic and ring management.\n\nTo fix this issue, replace the call to ath12k_hal_srng_src_get_next_entry with\nath12k_hal_srng_dst_get_next_entry in ath12k_dp_mon_srng_process. This ensures\nthat the correct function is used for fetching entries from the destination\nring, preventing invalid memory accesses.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1\nTested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The monitor destination ring is fed by received 802.11 PPDUs, so the trigger is a Wi-Fi frame transmitted by an attacker within radio range of the QCN9274 radio. Per kernel scoring guidance, WiFi frame injection is Adjacent.\nAC:L - The wrong-ring-accessor bug fires deterministically on the last descriptor of every NAPI poll, and the attacker controls the trigger rate simply by transmitting frames; no race or memory layout beyond attacker influence is involved.\nPR:N - The default monitor status filter is installed in ath12k_mac_start() regardless of monitor mode, and it captures management/control/data frames pre-association, so an unauthenticated, unassociated attacker in range reaches the code path.\nUI:N - No victim action is needed — the monitor status ring is armed automatically when the radio is brought up, and processing happens in NAPI softirq context on frame receipt.\nS:U - The corruption and crash stay within the kernel's own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Re-processing stale descriptors makes the driver hand hardware-owned buffers, and stale buffer contents, into the TLV parser and up the receive path, and the resulting memory corruption is leverageable for kernel memory disclosure.\nI:H - A recycled buf_id causes idr_remove()/dma_unmap_single()/dev_kfree_skb_any() on a buffer the device still owns, so the NIC DMAs attacker-influenced 802.11 data into freed and reallocated kernel heap — a write-after-free primitive; the fix commit itself cites \"potential data corruption.\"\nA:H - The loop burns the full NAPI/service budget on every poll while churning buffer replenishment, and the stale-descriptor path yields NULL dereferences and DMA-after-free crashes, causing kernel oops and sustained CPU/softirq starvation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/dp_mon.c" ], "versions": [ { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "2c512f2eadabb1e80816116894ffaf7d802a944e", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "ab7edf42ce800eb34d2f73dd7271b826661a06a5", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "b6a3b2b2cead103089d3bb7a57d8209bdfa5399d", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "298f0aea5cb32b5038f991f5db201a0fcbb9a31b", "status": "affected", "versionType": "git" }, { "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "63fdc4509bcf483e79548de6bc08bf3c8e504bb3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath12k/dp_mon.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.88", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.25", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.12", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.4", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.88" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.25" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.13.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.14.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2c512f2eadabb1e80816116894ffaf7d802a944e" }, { "url": "https://git.kernel.org/stable/c/ab7edf42ce800eb34d2f73dd7271b826661a06a5" }, { "url": "https://git.kernel.org/stable/c/b6a3b2b2cead103089d3bb7a57d8209bdfa5399d" }, { "url": "https://git.kernel.org/stable/c/298f0aea5cb32b5038f991f5db201a0fcbb9a31b" }, { "url": "https://git.kernel.org/stable/c/63fdc4509bcf483e79548de6bc08bf3c8e504bb3" } ], "title": "wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process", "x_generator": { "engine": "bippy-1.2.0" } } } }