CVE-2025-37943

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37943", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.972Z", "datePublished": "2025-05-20T15:58:19.607Z", "dateUpdated": "2026-08-05T11:58:31.647Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:31.647Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi\n\nIn certain cases, hardware might provide packets with a\nlength greater than the maximum native Wi-Fi header length.\nThis can lead to accessing and modifying fields in the header\nwithin the ath12k_dp_rx_h_undecap_nwifi function for\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type and\npotentially resulting in invalid data access and memory corruption.\n\nAdd a sanity check before processing the SKB to prevent invalid\ndata access in the undecap native Wi-Fi function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable code is the ath12k 802.11 receive path, triggered by a crafted 4-address QoS data frame with the Order bit set that is injected over the air; the attacker must be within Wi-Fi radio range of the target radio. Per kernel guidance, WiFi frame injection is Adjacent.\nAC:L - The attacker fully controls the frame_control field and header contents of the injected frame and can retransmit indefinitely until it lands in the native-Wi-Fi decap or WBM error path; no condition outside the attacker's control is required, and the ath11k twin fix documents real observed stack corruption from this exact path.\nPR:N - No authentication or association is needed \u2014 the frame only has to pass the hardware address filter, and the patched null_q_desc/tkip_mic_err error paths specifically handle frames with no peer and no REO queue (ath12k_dp_rx_h_mpdu falls back to HAL_ENCRYPT_TYPE_OPEN when peer lookup fails).\nUI:N - The corruption happens in the NAPI receive path as soon as the frame is processed; no victim action is required beyond having the wireless interface up.\nS:U - The out-of-bounds write corrupts the kernel stack of the receiving host, staying within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The trailing memcpy reads up to 36 bytes from the 30-byte stack array and copies the result into the skb that is delivered to mac80211 (and forwarded in AP/mesh mode), leaking adjacent kernel stack and stale DMA buffer contents; the attacker-controlled stack corruption is further leverageable as a memory-disclosure primitive.\nI:H - Up to 6 bytes of attacker-chosen 802.11 header data are written past a 30-byte stack buffer, overwriting adjacent locals, the stack canary, or saved registers \u2014 an out-of-bounds write with controlled content that is a control-flow-hijack primitive.\nA:H - Kernel stack corruption reliably produces a panic via __stack_chk_fail or FORTIFY_SOURCE, and the mishandled skb_pull/skb_push can trigger skb_under_panic; the ath11k report confirms an observed \"Kernel stack is corrupted\" crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath12k/dp_rx.c"], "versions": [{"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c", "status": "affected", "versionType": "git"}, {"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "3abe15e756481c45f6acba3d476cb3ca4afc3b61", "status": "affected", "versionType": "git"}, {"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "6ee653194ddb83674913fd2727b8ecfae0597ade", "status": "affected", "versionType": "git"}, {"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "50be1fb76556e80af9f5da80f28168b6c71bce58", "status": "affected", "versionType": "git"}, {"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "9a0dddfb30f120db3851627935851d262e4e7acb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath12k/dp_rx.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.88", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.24", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.12", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.3", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.13.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.14.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c"}, {"url": "https://git.kernel.org/stable/c/3abe15e756481c45f6acba3d476cb3ca4afc3b61"}, {"url": "https://git.kernel.org/stable/c/6ee653194ddb83674913fd2727b8ecfae0597ade"}, {"url": "https://git.kernel.org/stable/c/50be1fb76556e80af9f5da80f28168b6c71bce58"}, {"url": "https://git.kernel.org/stable/c/9a0dddfb30f120db3851627935851d262e4e7acb"}], "title": "wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath12k/dp_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git"}, {"lessThan": "3abe15e756481c45f6acba3d476cb3ca4afc3b61", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git"}, {"lessThan": "6ee653194ddb83674913fd2727b8ecfae0597ade", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git"}, {"lessThan": "50be1fb76556e80af9f5da80f28168b6c71bce58", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git"}, {"lessThan": "9a0dddfb30f120db3851627935851d262e4e7acb", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath12k/dp_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.88", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.24", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.12", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E490AC3E-4FCB-404E-B82F-0DE1390D06A2", "versionEndExcluding": "6.6.88", "versionStartIncluding": "6.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D35A8A8-F3EC-45E6-AD37-1F154B27529D", "versionEndExcluding": "6.12.24", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A475784-BF3B-4514-81EE-49C8522FB24A", "versionEndExcluding": "6.13.12", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "483E2E15-2135-4EC6-AB64-16282C5EF704", "versionEndExcluding": "6.14.3", "versionStartIncluding": "6.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi\n\nIn certain cases, hardware might provide packets with a\nlength greater than the maximum native Wi-Fi header length.\nThis can lead to accessing and modifying fields in the header\nwithin the ath12k_dp_rx_h_undecap_nwifi function for\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type and\npotentially resulting in invalid data access and memory corruption.\n\nAdd a sanity check before processing the SKB to prevent invalid\ndata access in the undecap native Wi-Fi function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: Se ha corregido el acceso no v\u00e1lido a datos en ath12k_dp_rx_h_undecap_nwifi. En ciertos casos, el hardware podr\u00eda proporcionar paquetes con una longitud superior a la longitud m\u00e1xima del encabezado Wi-Fi nativo. Esto puede provocar el acceso y la modificaci\u00f3n de campos del encabezado dentro de la funci\u00f3n ath12k_dp_rx_h_undecap_nwifi para el tipo de decap DP_RX_DECAP_TYPE_NATIVE_WIFI, lo que podr\u00eda provocar acceso no v\u00e1lido a datos y corrupci\u00f3n de memoria. Se ha a\u00f1adido una comprobaci\u00f3n de seguridad antes de procesar el SKB para evitar el acceso no v\u00e1lido a datos en la funci\u00f3n Wi-Fi nativa undecap para el tipo de decap DP_RX_DECAP_TYPE_NATIVE_WIFI. Probado en: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1."}], "id": "CVE-2025-37943", "lastModified": "2026-07-30T06:22:35.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-05-20T16:15:32.133", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3abe15e756481c45f6acba3d476cb3ca4afc3b61"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50be1fb76556e80af9f5da80f28168b6c71bce58"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6ee653194ddb83674913fd2727b8ecfae0597ade"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a0dddfb30f120db3851627935851d262e4e7acb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:8669", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "kernel-0:6.12.0-55.16.1.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-06-09T00:00:00Z"}, {"advisory": "RHSA-2025:8643", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.21.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-06-09T00:00:00Z"}, {"advisory": "RHSA-2025:8643", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.21.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-06-09T00:00:00Z"}, {"advisory": "RHSA-2025:9068", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kpatch-patch", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-06-16T00:00:00Z"}], "bugzilla": {"description": "kernel: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi", "id": "2367748", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2367748"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-253", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi\nIn certain cases, hardware might provide packets with a\nlength greater than the maximum native Wi-Fi header length.\nThis can lead to accessing and modifying fields in the header\nwithin the ath12k_dp_rx_h_undecap_nwifi function for\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type and\npotentially resulting in invalid data access and memory corruption.\nAdd a sanity check before processing the SKB to prevent invalid\ndata access in the undecap native Wi-Fi function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type.\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1"], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the `ath12k` module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Note that this will make hardware that uses that chipset unavailable, so this mitigation is not suitable for systems that rely on Qualcomm Wi-Fi 7 network adapters."}, "name": "CVE-2025-37943", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37943\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37943\nhttps://lore.kernel.org/linux-cve-announce/2025052043-CVE-2025-37943-9cf8@gregkh/T"], "statement": "This vulnerability in the ath12k driver can be exploited when hardware which uses that driver provides malformed packets, specifically packets with a header length longer than permitted by the Wi-Fi specification. An attacker who can generate packets to be processed by this driver could exploit this flaw to alter kernel memory, resulting in the ability to escalate their privileges or otherwise compromise system integrity and stability.\nThese drivers are not included in Red Hat Enterprise Linux 8 and previous, so those systems are unaffected.", "threat_severity": "Important"}

{}