wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 9 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kernel panic. Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it directly to avoid panic and unnecessary dereferencing. PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]" LR points to "ath12k_dp_tx+0xc8/0x988 [ath12k]". The Backtrace obtained is as follows: ath12k_dp_tx+0x228/0x988 [ath12k] ath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k] ieee80211_process_measurement_req+0x320/0x348 [mac80211] ieee80211_tx_dequeue+0x9ac/0x1518 [mac80211] ieee80211_tx_dequeue+0xb14/0x1518 [mac80211] ieee80211_tx_prepare_skb+0x224/0x254 [mac80211] ieee80211_xmit+0xec/0x100 [mac80211] __ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211] ieee80211_subif_start_xmit+0x2e8/0x308 [mac80211] netdev_start_xmit+0x150/0x18c dev_hard_start_xmit+0x74/0xc0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://git.kernel.org/stable/c/be27a11a42b2190f817b198bf5e753e5e4ac849e
- https://git.kernel.org/stable/c/d9d2a0466e981d1be95fc8bdc05806ea21def758
- https://git.kernel.org/stable/c/b508f370f88f277c95e2bd3bc47217a96d668cee
- https://git.kernel.org/stable/c/ee4f8e7fa578f9f28cef5f409677db25f4f83d7e
- https://git.kernel.org/stable/c/05062834350f0bf7ad1abcebc2807220e90220eb
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-27930
- GCVE · GCVE-0-2025-38605
CERT-FR advisories
- CERTFR-2025-AVI-1135 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1075 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1073 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1050 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0921 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0895 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0841 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.4 < 6.15.10cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.16 < 6.16.1
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected e93bbd65547ea8073b707c9034c3f051f8018614 < be27a11a42b2190f817b198bf5e753e5e4ac849e ; affected e93bbd65547ea8073b707c9034c3f051f8018614 < d9d2a0466e981d1be95fc8bdc05806ea21def758 ; affected e93bbd65547ea8073b707c9034c3f051f8018614 < b508f370f88f277c95e2bd3bc47217a96d668cee ; affected e93bbd65547ea8073b707c9034c3f051f8018614 < ee4f8e7fa578f9f28cef5f409677db25f4f83d7e ; affected e93bbd65547ea8073b707c9034c3f051f8018614 < 05062834350f0bf7ad1abcebc2807220e90220eb |
| Linux · Linux | affected 6.4 ; unaffected 0 < 6.4 ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.15.10 ≤ 6.15.* ; unaffected 6.16.1 ≤ 6.16.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |