{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38291","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:24.001Z","datePublished":"2025-07-10T07:42:06.899Z","dateUpdated":"2026-10-15T21:52:13.663Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:01:01.265Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Prevent sending WMI commands to firmware during firmware crash\n\nCurrently, we encounter the following kernel call trace when a firmware\ncrash occurs. This happens because the host sends WMI commands to the\nfirmware while it is in recovery, causing the commands to fail and\nresulting in the kernel call trace.\n\nSet the ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags when the\nhost driver receives the firmware crash notification from MHI. This\nprevents sending WMI commands to the firmware during recovery.\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x75/0xc0\n register_lock_class+0x6be/0x7a0\n ? __lock_acquire+0x644/0x19a0\n __lock_acquire+0x95/0x19a0\n lock_acquire+0x265/0x310\n ? ath12k_ce_send+0xa2/0x210 [ath12k]\n ? find_held_lock+0x34/0xa0\n ? ath12k_ce_send+0x56/0x210 [ath12k]\n _raw_spin_lock_bh+0x33/0x70\n ? ath12k_ce_send+0xa2/0x210 [ath12k]\n ath12k_ce_send+0xa2/0x210 [ath12k]\n ath12k_htc_send+0x178/0x390 [ath12k]\n ath12k_wmi_cmd_send_nowait+0x76/0xa0 [ath12k]\n ath12k_wmi_cmd_send+0x62/0x190 [ath12k]\n ath12k_wmi_pdev_bss_chan_info_request+0x62/0xc0 [ath1\n ath12k_mac_op_get_survey+0x2be/0x310 [ath12k]\n ieee80211_dump_survey+0x99/0x240 [mac80211]\n nl80211_dump_survey+0xe7/0x470 [cfg80211]\n ? kmalloc_reserve+0x59/0xf0\n genl_dumpit+0x24/0x70\n netlink_dump+0x177/0x360\n __netlink_dump_start+0x206/0x280\n genl_family_rcv_msg_dumpit.isra.22+0x8a/0xe0\n ? genl_family_rcv_msg_attrs_parse.isra.23+0xe0/0xe0\n ? genl_op_lock.part.12+0x10/0x10\n ? genl_dumpit+0x70/0x70\n genl_rcv_msg+0x1d0/0x290\n ? nl80211_del_station+0x330/0x330 [cfg80211]\n ? genl_get_cmd_both+0x50/0x50\n netlink_rcv_skb+0x4f/0x100\n genl_rcv+0x1f/0x30\n netlink_unicast+0x1b6/0x260\n netlink_sendmsg+0x31a/0x450\n __sock_sendmsg+0xa8/0xb0\n ____sys_sendmsg+0x1e4/0x260\n ___sys_sendmsg+0x89/0xe0\n ? local_clock_noinstr+0xb/0xc0\n ? rcu_is_watching+0xd/0x40\n ? kfree+0x1de/0x370\n ? __sys_sendmsg+0x7a/0xc0\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the ath12k Wi-Fi driver's firmware-crash handling, and the trigger precondition — a firmware crash reported via MHI_CB_EE_RDDM — is inducible over the air by an unauthenticated attacker within radio range sending malformed 802.11 frames to a QCN9274/WCN7850 radio. The racing WMI traffic is generated automatically by hostapd/wpa_supplicant survey and station-stats polling, so no local access is needed.\nAC:L - The commit states the call trace occurs whenever a firmware crash happens, so the unguarded window is entered deterministically, and the window is wide (it spans ath12k_coredump_collect() plus the whole reset/power-down/QMI cycle). The attacker can repeat the crash and, if local, can also drive the netlink survey-dump side of the race in a tight loop, controlling both sides.\nPR:N - An adjacent attacker needs no credentials on the target to crash the firmware, and the concurrent WMI command path is driven by the system's own daemons polling nl80211 survey/station statistics. Even in the purely local framing, NL80211_CMD_GET_SURVEY carries no GENL_ADMIN_PERM flag, so any unprivileged user can reach ath12k_mac_op_get_survey().\nUI:N - No victim action is required; hostapd/NetworkManager poll survey and station statistics on a timer, and the firmware-crash recovery path runs automatically from workqueue context.\nS:U - The corruption and the crash are confined to the kernel's own memory and the ath12k device state, with no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - ath12k_hal_srng_access_begin() reads through srng->u.src_ring.tp_addr, which points into the DMA-coherent buffer already released by ath12k_hal_free_cont_rdp(); this use-after-free read of recycled memory, together with the torn-down srng/HAL state, is treated as a high confidentiality impact.\nI:H - ath12k_hal_srng_access_end() writes through srng->u.src_ring.hp_addr into the freed hal->wrp coherent buffer, and ath12k_ce_send() writes descriptors and pipe->src_ring->skb[] entries against srng state being concurrently memset by ath12k_hal_srng_init(), giving a use-after-free write into memory that can be reallocated to another consumer.\nA:H - Once ath12k_hal_srng_init() zeroes ab->hal, tp_addr/ring_base_vaddr become NULL and the dereference in ath12k_hal_srng_access_begin() oopses; the reported lockdep \"non-static key\" splat also disables the locking validator, and the WMI waits stall the Wi-Fi interface during recovery."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath12k/mhi.c"],"versions":[{"version":"a9b46dd2e483bf99fa09e6aeea7701960abaa902","lessThan":"2563069baf243cadc76dc64d9085606742c4b282","status":"affected","versionType":"git"},{"version":"a9b46dd2e483bf99fa09e6aeea7701960abaa902","lessThan":"e9e094a9734ea3bd4d4d117c915ccf129ac61ba1","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath12k/mhi.c"],"versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","status":"unaffected","versionType":"semver"},{"version":"6.15.3","lessThanOrEqual":"6.15.*","status":"unaffected","versionType":"semver"},{"version":"6.16","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.15.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.16"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2563069baf243cadc76dc64d9085606742c4b282"},{"url":"https://git.kernel.org/stable/c/e9e094a9734ea3bd4d4d117c915ccf129ac61ba1"}],"title":"wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-38291","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:49:22.834366Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T21:52:13.663Z"}}]}}