CVE-2025-23133

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-23133", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-11T14:28:41.511Z", "datePublished": "2025-04-16T14:13:14.485Z", "dateUpdated": "2026-10-21T12:36:20.439Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:36:20.439Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: update channel list in reg notifier instead reg worker\n\nCurrently when ath11k gets a new channel list, it will be processed\naccording to the following steps:\n1. update new channel list to cfg80211 and queue reg_work.\n2. cfg80211 handles new channel list during reg_work.\n3. update cfg80211's handled channel list to firmware by\nath11k_reg_update_chan_list().\n\nBut ath11k will immediately execute step 3 after reg_work is just\nqueued. Since step 2 is asynchronous, cfg80211 may not have completed\nhandling the new channel list, which may leading to an out-of-bounds\nwrite error:\nBUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list\nCall Trace:\n ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]\n kfree+0x109/0x3a0\n ath11k_regd_update+0x1cf/0x350 [ath11k]\n ath11k_regd_update_work+0x14/0x20 [ath11k]\n process_one_work+0xe35/0x14c0\n\nShould ensure step 2 is completely done before executing step 3. Thus\nWen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set,\ncfg80211 will notify ath11k after step 2 is done.\n\nSo enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will\nnotify ath11k after step 2 is done. At this time, there will be no\nKASAN bug during the execution of the step 3.\n\n[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The trigger is an 802.11d Country IE in beacons/probe responses harvested by the firmware's periodic 11d offload scan, which drives `WMI_11D_NEW_COUNTRY_EVENTID` \u2192 `ath11k_reg_set_cc()` \u2192 `WMI_REG_CHAN_LIST_CC_EVENTID` \u2192 `ath11k_regd_update_work`. This requires only RF proximity to the victim's Wi-Fi radio, matching the adjacent-network scope for Wi-Fi frame injection.\nAC:L - The attacker initiates both racing workers with a single beaconed country change \u2014 `ath11k_regd_update_work` on the ath11k workqueue and cfg80211's `reg_work` on the system workqueue \u2014 and the window is widened by the sleeping `kzalloc(GFP_KERNEL)` and per-channel `ath11k_dbg()` calls between the counting and filling loops. Since 11d scans repeat on a fixed interval and the attacker can toggle the advertised country indefinitely, the race can be retried until won.\nPR:N - No credentials, association, or authentication are needed \u2014 the firmware's 11d scan ingests Country IEs from unassociated broadcast beacons of any AP in range. No local account on the victim is involved at any point in the path.\nUI:N - A station interface that is simply up and scanning (the normal state for a laptop, phone, or embedded client) runs the 11d scan automatically; no user action such as connecting to the rogue AP is required. The regdomain update and the racing workers are entirely kernel-internal once the beacon is received.\nS:U - The out-of-bounds write corrupts kernel slab memory adjacent to the `scan_chan_list_params` allocation, staying within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A heap out-of-bounds write of up to ~1\u20132 KB of `struct channel_param` records overwrites adjacent slab objects, which can be groomed (e.g. onto neighboring length or pointer fields) to yield an information-disclosure primitive. Per kernel scoring guidance, memory corruption that can be leveraged for disclosure rates High.\nI:H - This is a genuine slab out-of-bounds write with attacker-influenced length (via race timing over which bands cfg80211 has re-enabled) and partially attacker-influenced contents (`mhz`, `cfreq1`, `maxpower`, `maxregpower`, `antennamax` derived from the attacker-chosen regdomain). Out-of-bounds writes into adjacent heap objects are a standard route to control-flow hijack and rate High.\nA:H - The bug was found as a KASAN slab-out-of-bounds report followed by heap corruption at `kfree()`, which reliably produces oopses/panics on hardened or SLUB-debug kernels and unpredictable kernel state otherwise. Any such crash of the kernel is a full availability loss."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/reg.c"], "versions": [{"version": "f45cb6b29cd36514e13f7519770873d8c0457008", "lessThan": "ec97bd5378c594be1f1c7a15dcf381e075b665d9", "status": "affected", "versionType": "git"}, {"version": "f45cb6b29cd36514e13f7519770873d8c0457008", "lessThan": "26618c039b78a76c373d4e02c5fbd52e3a73aead", "status": "affected", "versionType": "git"}, {"version": "f45cb6b29cd36514e13f7519770873d8c0457008", "lessThan": "f952fb83c9c6f908d27500764c4aee1df04b9d3f", "status": "affected", "versionType": "git"}, {"version": "f45cb6b29cd36514e13f7519770873d8c0457008", "lessThan": "933ab187e679e6fbdeea1835ae39efcc59c022d2", "status": "affected", "versionType": "git"}, {"version": "f96fd36936310cefe0ea1370a9ae30e6746e6f62", "status": "affected", "versionType": "git"}, {"version": "c97b120950b49d76bdce013bd4d9577d769465f4", "status": "affected", "versionType": "git"}, {"version": "5.15.79", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.0.9", "lessThan": "6.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/reg.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.46", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.2", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.14.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.79"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ec97bd5378c594be1f1c7a15dcf381e075b665d9"}, {"url": "https://git.kernel.org/stable/c/26618c039b78a76c373d4e02c5fbd52e3a73aead"}, {"url": "https://git.kernel.org/stable/c/f952fb83c9c6f908d27500764c4aee1df04b9d3f"}, {"url": "https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"}], "title": "wifi: ath11k: update channel list in reg notifier instead reg worker", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23133", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:44:40.826018Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:58.417Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23133", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:44:40.826018Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:44:41.635Z"}}], "cna": {"title": "wifi: ath11k: update channel list in reg notifier instead reg worker", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The trigger is an 802.11d Country IE in beacons/probe responses harvested by the firmware's periodic 11d offload scan, which drives `WMI_11D_NEW_COUNTRY_EVENTID` \u2192 `ath11k_reg_set_cc()` \u2192 `WMI_REG_CHAN_LIST_CC_EVENTID` \u2192 `ath11k_regd_update_work`. This requires only RF proximity to the victim's Wi-Fi radio, matching the adjacent-network scope for Wi-Fi frame injection.\nAC:L - The attacker initiates both racing workers with a single beaconed country change \u2014 `ath11k_regd_update_work` on the ath11k workqueue and cfg80211's `reg_work` on the system workqueue \u2014 and the window is widened by the sleeping `kzalloc(GFP_KERNEL)` and per-channel `ath11k_dbg()` calls between the counting and filling loops. Since 11d scans repeat on a fixed interval and the attacker can toggle the advertised country indefinitely, the race can be retried until won.\nPR:N - No credentials, association, or authentication are needed \u2014 the firmware's 11d scan ingests Country IEs from unassociated broadcast beacons of any AP in range. No local account on the victim is involved at any point in the path.\nUI:N - A station interface that is simply up and scanning (the normal state for a laptop, phone, or embedded client) runs the 11d scan automatically; no user action such as connecting to the rogue AP is required. The regdomain update and the racing workers are entirely kernel-internal once the beacon is received.\nS:U - The out-of-bounds write corrupts kernel slab memory adjacent to the `scan_chan_list_params` allocation, staying within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A heap out-of-bounds write of up to ~1\u20132 KB of `struct channel_param` records overwrites adjacent slab objects, which can be groomed (e.g. onto neighboring length or pointer fields) to yield an information-disclosure primitive. Per kernel scoring guidance, memory corruption that can be leveraged for disclosure rates High.\nI:H - This is a genuine slab out-of-bounds write with attacker-influenced length (via race timing over which bands cfg80211 has re-enabled) and partially attacker-influenced contents (`mhz`, `cfreq1`, `maxpower`, `maxregpower`, `antennamax` derived from the attacker-chosen regdomain). Out-of-bounds writes into adjacent heap objects are a standard route to control-flow hijack and rate High.\nA:H - The bug was found as a KASAN slab-out-of-bounds report followed by heap corruption at `kfree()`, which reliably produces oopses/panics on hardened or SLUB-debug kernels and unpredictable kernel state otherwise. Any such crash of the kernel is a full availability loss."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f45cb6b29cd36514e13f7519770873d8c0457008", "lessThan": "ec97bd5378c594be1f1c7a15dcf381e075b665d9", "versionType": "git"}, {"status": "affected", "version": "f45cb6b29cd36514e13f7519770873d8c0457008", "lessThan": "26618c039b78a76c373d4e02c5fbd52e3a73aead", "versionType": "git"}, {"status": "affected", "version": "f45cb6b29cd36514e13f7519770873d8c0457008", "lessThan": "f952fb83c9c6f908d27500764c4aee1df04b9d3f", "versionType": "git"}, {"status": "affected", "version": "f45cb6b29cd36514e13f7519770873d8c0457008", "lessThan": "933ab187e679e6fbdeea1835ae39efcc59c022d2", "versionType": "git"}, {"status": "affected", "version": "f96fd36936310cefe0ea1370a9ae30e6746e6f62", "versionType": "git"}, {"status": "affected", "version": "c97b120950b49d76bdce013bd4d9577d769465f4", "versionType": "git"}, {"status": "affected", "version": "5.15.79", "lessThan": "5.16", "versionType": "semver"}, {"status": "affected", "version": "6.0.9", "lessThan": "6.1", "versionType": "semver"}], "programFiles": ["drivers/net/wireless/ath/ath11k/reg.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"status": "unaffected", "version": "0", "lessThan": "6.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.46", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.2", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/ath/ath11k/reg.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ec97bd5378c594be1f1c7a15dcf381e075b665d9"}, {"url": "https://git.kernel.org/stable/c/26618c039b78a76c373d4e02c5fbd52e3a73aead"}, {"url": "https://git.kernel.org/stable/c/f952fb83c9c6f908d27500764c4aee1df04b9d3f"}, {"url": "https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: update channel list in reg notifier instead reg worker\n\nCurrently when ath11k gets a new channel list, it will be processed\naccording to the following steps:\n1. update new channel list to cfg80211 and queue reg_work.\n2. cfg80211 handles new channel list during reg_work.\n3. update cfg80211's handled channel list to firmware by\nath11k_reg_update_chan_list().\n\nBut ath11k will immediately execute step 3 after reg_work is just\nqueued. Since step 2 is asynchronous, cfg80211 may not have completed\nhandling the new channel list, which may leading to an out-of-bounds\nwrite error:\nBUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list\nCall Trace:\n ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]\n kfree+0x109/0x3a0\n ath11k_regd_update+0x1cf/0x350 [ath11k]\n ath11k_regd_update_work+0x14/0x20 [ath11k]\n process_one_work+0xe35/0x14c0\n\nShould ensure step 2 is completely done before executing step 3. Thus\nWen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set,\ncfg80211 will notify ath11k after step 2 is done.\n\nSo enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will\nnotify ath11k after step 2 is done. At this time, there will be no\nKASAN bug during the execution of the step 3.\n\n[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.46", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.2", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.15.79"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.0.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:36:20.439Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23133", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:36:20.439Z", "dateReserved": "2025-01-11T14:28:41.511Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-04-16T14:13:14.485Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/reg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ec97bd5378c594be1f1c7a15dcf381e075b665d9", "status": "affected", "version": "f45cb6b29cd36514e13f7519770873d8c0457008", "versionType": "git"}, {"lessThan": "26618c039b78a76c373d4e02c5fbd52e3a73aead", "status": "affected", "version": "f45cb6b29cd36514e13f7519770873d8c0457008", "versionType": "git"}, {"lessThan": "f952fb83c9c6f908d27500764c4aee1df04b9d3f", "status": "affected", "version": "f45cb6b29cd36514e13f7519770873d8c0457008", "versionType": "git"}, {"lessThan": "933ab187e679e6fbdeea1835ae39efcc59c022d2", "status": "affected", "version": "f45cb6b29cd36514e13f7519770873d8c0457008", "versionType": "git"}, {"status": "affected", "version": "f96fd36936310cefe0ea1370a9ae30e6746e6f62", "versionType": "git"}, {"status": "affected", "version": "c97b120950b49d76bdce013bd4d9577d769465f4", "versionType": "git"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.79", "versionType": "semver"}, {"lessThan": "6.1", "status": "affected", "version": "6.0.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/reg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.46", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "822C0821-6629-44AD-A634-DD034F122D51", "versionEndExcluding": "5.16", "versionStartIncluding": "5.15.79", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "28CC5A62-2D03-429C-A726-BF09788C85CA", "versionEndExcluding": "6.1", "versionStartIncluding": "6.0.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1E11135-1899-42F7-9AB6-89869E23C91D", "versionEndExcluding": "6.12.46", "versionStartIncluding": "6.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "633A38C1-75C8-452D-8F1C-DA0269FD2687", "versionEndExcluding": "6.14.2", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:*", "matchCriteriaId": "DE093B34-F4CD-4052-8122-730D6537A91A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*", "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*", "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: update channel list in reg notifier instead reg worker\n\nCurrently when ath11k gets a new channel list, it will be processed\naccording to the following steps:\n1. update new channel list to cfg80211 and queue reg_work.\n2. cfg80211 handles new channel list during reg_work.\n3. update cfg80211's handled channel list to firmware by\nath11k_reg_update_chan_list().\n\nBut ath11k will immediately execute step 3 after reg_work is just\nqueued. Since step 2 is asynchronous, cfg80211 may not have completed\nhandling the new channel list, which may leading to an out-of-bounds\nwrite error:\nBUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list\nCall Trace:\n ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]\n kfree+0x109/0x3a0\n ath11k_regd_update+0x1cf/0x350 [ath11k]\n ath11k_regd_update_work+0x14/0x20 [ath11k]\n process_one_work+0xe35/0x14c0\n\nShould ensure step 2 is completely done before executing step 3. Thus\nWen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set,\ncfg80211 will notify ath11k after step 2 is done.\n\nSo enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will\nnotify ath11k after step 2 is done. At this time, there will be no\nKASAN bug during the execution of the step 3.\n\n[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath11k: actualizar la lista de canales en el notificador de registros en lugar del trabajador de registros. Actualmente, cuando ath11k obtiene una nueva lista de canales, esta se procesa seg\u00fan los siguientes pasos: 1. Actualizar la nueva lista de canales a cfg80211 y poner en cola reg_work. 2. cfg80211 gestiona la nueva lista de canales durante reg_work. 3. Actualizar la lista de canales gestionada de cfg80211 al firmware mediante ath11k_reg_update_chan_list(). Sin embargo, ath11k ejecutar\u00e1 inmediatamente el paso 3 despu\u00e9s de poner en cola reg_work. Como el paso 2 es asincr\u00f3nico, es posible que cfg80211 no haya terminado de manejar la nueva lista de canales, lo que puede generar un error de escritura fuera de los l\u00edmites: BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list Call Trace: ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k] kfree+0x109/0x3a0 ath11k_regd_update+0x1cf/0x350 [ath11k] ath11k_regd_update_work+0x14/0x20 [ath11k] process_one_work+0xe35/0x14c0 Se debe asegurar que el paso 2 se haya realizado completamente antes de ejecutar el paso 3. Por lo tanto, Wen plante\u00f3 patch[1]. Cuando se activa el indicador NL80211_REGDOM_SET_BY_DRIVER, cfg80211 notificar\u00e1 a ath11k una vez finalizado el paso 2. Por lo tanto, al activar el indicador NL80211_REGDOM_SET_BY_DRIVER, cfg80211 notificar\u00e1 a ath11k una vez finalizado el paso 2. En este momento, no se producir\u00e1 ning\u00fan error de KASAN durante la ejecuci\u00f3n del paso 3. [1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/ Probado en: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"}], "id": "CVE-2025-23133", "lastModified": "2026-10-21T13:18:05.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-23133", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:44:40.826018Z", "version": "2.0.3"}}]}, "published": "2025-04-16T15:16:07.717", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/26618c039b78a76c373d4e02c5fbd52e3a73aead"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec97bd5378c594be1f1c7a15dcf381e075b665d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f952fb83c9c6f908d27500764c4aee1df04b9d3f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: ath11k: update channel list in reg notifier instead reg worker", "id": "2360279", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2360279"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: ath11k: update channel list in reg notifier instead reg worker\nCurrently when ath11k gets a new channel list, it will be processed\naccording to the following steps:\n1. update new channel list to cfg80211 and queue reg_work.\n2. cfg80211 handles new channel list during reg_work.\n3. update cfg80211's handled channel list to firmware by\nath11k_reg_update_chan_list().\nBut ath11k will immediately execute step 3 after reg_work is just\nqueued. Since step 2 is asynchronous, cfg80211 may not have completed\nhandling the new channel list, which may leading to an out-of-bounds\nwrite error:\nBUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list\nCall Trace:\nath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]\nkfree+0x109/0x3a0\nath11k_regd_update+0x1cf/0x350 [ath11k]\nath11k_regd_update_work+0x14/0x20 [ath11k]\nprocess_one_work+0xe35/0x14c0\nShould ensure step 2 is completely done before executing step 3. Thus\nWen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set,\ncfg80211 will notify ath11k after step 2 is done.\nSo enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will\nnotify ath11k after step 2 is done. At this time, there will be no\nKASAN bug during the execution of the step 3.\n[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"], "name": "CVE-2025-23133", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-23133\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-23133\nhttps://lore.kernel.org/linux-cve-announce/2025041632-CVE-2025-23133-c1c5@gregkh/T"], "threat_severity": "Moderate"}

{}