{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38293", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.001Z", "datePublished": "2025-07-10T07:42:08.230Z", "dateUpdated": "2026-08-05T12:01:03.363Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:03.363Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix node corruption in ar->arvifs list\n\nIn current WLAN recovery code flow, ath11k_core_halt() only\nreinitializes the \"arvifs\" list head. This will cause the\nlist node immediately following the list head to become an\ninvalid list node. Because the prev of that node still points\nto the list head \"arvifs\", but the next of the list head \"arvifs\"\nno longer points to that list node.\n\nWhen a WLAN recovery occurs during the execution of a vif\nremoval, and it happens before the spin_lock_bh(&ar->data_lock)\nin ath11k_mac_op_remove_interface(), list_del() will detect the\npreviously mentioned situation, thereby triggering a kernel panic.\n\nThe fix is to remove and reinitialize all vif list nodes from the\nlist head \"arvifs\" during WLAN halt. The reinitialization is to make\nthe list nodes valid, ensuring that the list_del() in\nath11k_mac_op_remove_interface() can execute normally.\n\nCall trace:\n__list_del_entry_valid_or_report+0xb8/0xd0\nath11k_mac_op_remove_interface+0xb0/0x27c [ath11k]\ndrv_remove_interface+0x48/0x194 [mac80211]\nieee80211_do_stop+0x6e0/0x844 [mac80211]\nieee80211_stop+0x44/0x17c [mac80211]\n__dev_close_many+0xac/0x150\n__dev_change_flags+0x194/0x234\ndev_change_flags+0x24/0x6c\ndevinet_ioctl+0x3a0/0x670\ninet_ioctl+0x200/0x248\nsock_do_ioctl+0x60/0x118\nsock_ioctl+0x274/0x35c\n__arm64_sys_ioctl+0xac/0xf0\ninvoke_syscall+0x48/0x114\n...\n\nTested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04591-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable code is in the ath11k Wi-Fi driver, and the triggering side of the race is a firmware crash/recovery (`MHI_CB_EE_RDDM` → `ab->reset_work`), which an attacker within radio range can induce with hostile/malformed 802.11 frames against QCA firmware. Exploitation therefore requires adjacency to the victim's WLAN, not routable network access.\nAC:L - `ath11k_core_halt()` runs from ath11k's own workqueue holding only `ar->conf_mutex`, while `ath11k_mac_op_remove_interface()` sits blocked in `cancel_work_sync()` and then on `conf_mutex` (held for seconds by timing-out WMI ops on crashed firmware), giving a very wide window; the attacker can force unlimited crash/recovery cycles, and each crash predictably causes the supplicant/WiFi framework to tear the interface down, so the attacker effectively drives both sides.\nPR:N - Inducing the firmware crash requires only transmitting frames in range — no credentials, association, or local account. The vif-removal side is performed automatically by system daemons (NetworkManager/wpa_supplicant/Android WiFi framework) reacting to the crash, not by a privileged attacker action.\nUI:N - No victim action is needed; the interface teardown that collides with recovery is an automated response by system daemons to the firmware crash the attacker induced.\nS:U - The list corruption and its consequences are confined to the kernel's own memory and security authority — no VM, IOMMU, or sandbox boundary is crossed.\nC:H - On kernels without list hardening the corrupted `list_del()` silently leaves `ar->arvifs` referencing `ath11k_vif` objects that are freed when the interface is destroyed; the ~20 iteration sites (WMI event handlers, regulatory update, spectral, WoW, TX paths) then read freed heap memory, yielding a use-after-free read primitive over attacker-groomable slab contents.\nI:H - `__list_del()` writes through the stale `prev`/`next` pointers, and a later `list_add(&arvif->list, &ar->arvifs)` writes a pointer into a freed object; combined with iteration that stores into dangling `arvif` fields, this is a use-after-free write primitive suitable for heap grooming and control-flow-relevant corruption.\nA:H - The commit documents a reproduced kernel panic via `__list_del_entry_valid_or_report` in `ath11k_mac_op_remove_interface`, and the attacker can repeat the crash/recovery cycle to re-trigger it, causing full denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath11k/core.c" ], "versions": [ { "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "6c139015b597e570dd5962934e9f9a2f4cc8ef48", "status": "affected", "versionType": "git" }, { "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f9507cf2dd0e1ed5028c0e8240da6fe5fd3110d3", "status": "affected", "versionType": "git" }, { "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "b0974ed82e6ad5ff246fd90a5b14f3e7be4f2924", "status": "affected", "versionType": "git" }, { "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f50ba7e7b607f2d00618799312e7fdb76a1ff48e", "status": "affected", "versionType": "git" }, { "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f5d77d0d41ea7a204d47288d0cf0404a52b5890e", "status": "affected", "versionType": "git" }, { "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "6d6cb27fe146061f2512e904618f5e005bb7bb6a", "status": "affected", "versionType": "git" }, { "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "31e98e277ae47f56632e4d663b1d4fd12ba33ea8", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath11k/core.c" ], "versions": [ { "version": "5.6", "status": "affected" }, { "version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.239", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.186", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.94", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.239" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.186" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.142" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.94" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.15.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6c139015b597e570dd5962934e9f9a2f4cc8ef48" }, { "url": "https://git.kernel.org/stable/c/f9507cf2dd0e1ed5028c0e8240da6fe5fd3110d3" }, { "url": "https://git.kernel.org/stable/c/b0974ed82e6ad5ff246fd90a5b14f3e7be4f2924" }, { "url": "https://git.kernel.org/stable/c/f50ba7e7b607f2d00618799312e7fdb76a1ff48e" }, { "url": "https://git.kernel.org/stable/c/f5d77d0d41ea7a204d47288d0cf0404a52b5890e" }, { "url": "https://git.kernel.org/stable/c/6d6cb27fe146061f2512e904618f5e005bb7bb6a" }, { "url": "https://git.kernel.org/stable/c/31e98e277ae47f56632e4d663b1d4fd12ba33ea8" } ], "title": "wifi: ath11k: fix node corruption in ar->arvifs list", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:36:17.536Z" } } ] } }