CVE-2025-38290

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38290", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.001Z", "datePublished": "2025-07-10T07:42:06.259Z", "dateUpdated": "2026-10-15T21:52:13.537Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:00.208Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix node corruption in ar->arvifs list\n\nIn current WLAN recovery code flow, ath12k_core_halt() only reinitializes\nthe \"arvifs\" list head. This will cause the list node immediately following\nthe list head to become an invalid list node. Because the prev of that node\nstill points to the list head \"arvifs\", but the next of the list head\n\"arvifs\" no longer points to that list node.\n\nWhen a WLAN recovery occurs during the execution of a vif removal, and it\nhappens before the spin_lock_bh(&ar->data_lock) in\nath12k_mac_vdev_delete(), list_del() will detect the previously mentioned\nsituation, thereby triggering a kernel panic.\n\nThe fix is to remove and reinitialize all vif list nodes from the list head\n\"arvifs\" during WLAN halt. The reinitialization is to make the list nodes\nvalid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute\nnormally.\n\nCall trace:\n__list_del_entry_valid_or_report+0xd4/0x100 (P)\nath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k]\nath12k_scan_vdev_clean_work+0x40/0x164 [ath12k]\ncfg80211_wiphy_work+0xfc/0x100\nprocess_one_work+0x164/0x2d0\nworker_thread+0x254/0x380\nkthread+0xfc/0x100\nret_from_fork+0x10/0x20\n\nThe change is mostly copied from the ath11k patch:\nhttps://lore.kernel.org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - Both halves of the race are driven over the air on the ath12k Wi-Fi 7 radio \u2014 firmware asserts (MHI_CB_EE_RDDM, the sole trigger for `ath12k_core_halt()`) are inducible by malformed/fuzzed 802.11 management frames, and link/vif teardown is driven by deauth/disassoc frames forcing disconnect-and-rescan cycles. No local access is needed, but the attacker must be within radio range, which is Adjacent rather than Network.\nAC:L - The attacker influences both sides of the race \u2014 repeatedly forcing firmware asserts while simultaneously forcing scan-link teardown via deauth floods \u2014 and the corruption window recurs on every recovery cycle, so no condition is outside attacker control. Per the race-condition guidance, attacker-driven races are Low.\nPR:N - Deauthentication/disassociation and malformed management frames are unauthenticated, pre-association 802.11 traffic (unprotected absent PMF), so no credentials on the target network or any local account are required. The vulnerable `ath12k_core_halt()` path runs entirely inside driver recovery with no capability check.\nUI:N - Firmware recovery, scan-link cleanup (`ath12k_scan_vdev_clean_work`) and connection-loss link teardown all execute automatically from cfg80211/mac80211 workqueues. No victim action is needed beyond having the interface up.\nS:U - The corruption and its consequences are confined to the kernel of the machine running the ath12k driver. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The half-reinitialized list leaves `ar->arvifs` pointing at `ath12k_link_vif` objects that `ath12k_mac_unassign_link_vif()` kfree()s, and later reverse traversal at mac.c:1262 reads through those dangling pointers and dereferences `arvif->ahvif` and `arvif->bssid`. That is a use-after-free read of groomable slab memory, which per the UAF guidance is High.\nI:H - `list_add(&arvif->list, &ar->arvifs)` (mac.c:10311) writes a kernel pointer into `head->next->prev`, i.e. into a freed `ath12k_link_vif` slab object, and `list_del()` on the corrupted node writes through stale prev/next \u2014 the classic list-corruption write primitive, exploitable for control-flow hijack after heap spraying.\nA:H - The documented symptom is a kernel panic via `__list_del_entry_valid_or_report` on `CONFIG_DEBUG_LIST`/`CONFIG_BUG_ON_DATA_CORRUPTION` builds; on builds without list debugging the resulting dangling-pointer traversal oopses instead. Either way the system crashes, and the condition is repeatable on every forced recovery."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath12k/core.c"], "versions": [{"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "be049199dec9189602bc06e2c70eda3aa0f2ea6e", "status": "affected", "versionType": "git"}, {"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "6285516170f9e2f04b9dbf1e5100e0d7cbac22b4", "status": "affected", "versionType": "git"}, {"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "6bfe7ae9bbd9734751b853e2d2e1c13e8b46fd2d", "status": "affected", "versionType": "git"}, {"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "823435bd23108d6f8be89ea2d025c0e2e3769c51", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath12k/core.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.94", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/be049199dec9189602bc06e2c70eda3aa0f2ea6e"}, {"url": "https://git.kernel.org/stable/c/6285516170f9e2f04b9dbf1e5100e0d7cbac22b4"}, {"url": "https://git.kernel.org/stable/c/6bfe7ae9bbd9734751b853e2d2e1c13e8b46fd2d"}, {"url": "https://git.kernel.org/stable/c/823435bd23108d6f8be89ea2d025c0e2e3769c51"}], "title": "wifi: ath12k: fix node corruption in ar->arvifs list", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38290", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:49:20.395606Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:13.537Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38290", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:49:20.395606Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:49:20.936Z"}}], "cna": {"title": "wifi: ath12k: fix node corruption in ar->arvifs list", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - Both halves of the race are driven over the air on the ath12k Wi-Fi 7 radio \u2014 firmware asserts (MHI_CB_EE_RDDM, the sole trigger for `ath12k_core_halt()`) are inducible by malformed/fuzzed 802.11 management frames, and link/vif teardown is driven by deauth/disassoc frames forcing disconnect-and-rescan cycles. No local access is needed, but the attacker must be within radio range, which is Adjacent rather than Network.\nAC:L - The attacker influences both sides of the race \u2014 repeatedly forcing firmware asserts while simultaneously forcing scan-link teardown via deauth floods \u2014 and the corruption window recurs on every recovery cycle, so no condition is outside attacker control. Per the race-condition guidance, attacker-driven races are Low.\nPR:N - Deauthentication/disassociation and malformed management frames are unauthenticated, pre-association 802.11 traffic (unprotected absent PMF), so no credentials on the target network or any local account are required. The vulnerable `ath12k_core_halt()` path runs entirely inside driver recovery with no capability check.\nUI:N - Firmware recovery, scan-link cleanup (`ath12k_scan_vdev_clean_work`) and connection-loss link teardown all execute automatically from cfg80211/mac80211 workqueues. No victim action is needed beyond having the interface up.\nS:U - The corruption and its consequences are confined to the kernel of the machine running the ath12k driver. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The half-reinitialized list leaves `ar->arvifs` pointing at `ath12k_link_vif` objects that `ath12k_mac_unassign_link_vif()` kfree()s, and later reverse traversal at mac.c:1262 reads through those dangling pointers and dereferences `arvif->ahvif` and `arvif->bssid`. That is a use-after-free read of groomable slab memory, which per the UAF guidance is High.\nI:H - `list_add(&arvif->list, &ar->arvifs)` (mac.c:10311) writes a kernel pointer into `head->next->prev`, i.e. into a freed `ath12k_link_vif` slab object, and `list_del()` on the corrupted node writes through stale prev/next \u2014 the classic list-corruption write primitive, exploitable for control-flow hijack after heap spraying.\nA:H - The documented symptom is a kernel panic via `__list_del_entry_valid_or_report` on `CONFIG_DEBUG_LIST`/`CONFIG_BUG_ON_DATA_CORRUPTION` builds; on builds without list debugging the resulting dangling-pointer traversal oopses instead. Either way the system crashes, and the condition is repeatable on every forced recovery."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "be049199dec9189602bc06e2c70eda3aa0f2ea6e", "versionType": "git"}, {"status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "6285516170f9e2f04b9dbf1e5100e0d7cbac22b4", "versionType": "git"}, {"status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "6bfe7ae9bbd9734751b853e2d2e1c13e8b46fd2d", "versionType": "git"}, {"status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "lessThan": "823435bd23108d6f8be89ea2d025c0e2e3769c51", "versionType": "git"}], "programFiles": ["drivers/net/wireless/ath/ath12k/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"status": "unaffected", "version": "0", "lessThan": "6.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.94", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.34", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.3", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/ath/ath12k/core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/be049199dec9189602bc06e2c70eda3aa0f2ea6e"}, {"url": "https://git.kernel.org/stable/c/6285516170f9e2f04b9dbf1e5100e0d7cbac22b4"}, {"url": "https://git.kernel.org/stable/c/6bfe7ae9bbd9734751b853e2d2e1c13e8b46fd2d"}, {"url": "https://git.kernel.org/stable/c/823435bd23108d6f8be89ea2d025c0e2e3769c51"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix node corruption in ar->arvifs list\n\nIn current WLAN recovery code flow, ath12k_core_halt() only reinitializes\nthe \"arvifs\" list head. This will cause the list node immediately following\nthe list head to become an invalid list node. Because the prev of that node\nstill points to the list head \"arvifs\", but the next of the list head\n\"arvifs\" no longer points to that list node.\n\nWhen a WLAN recovery occurs during the execution of a vif removal, and it\nhappens before the spin_lock_bh(&ar->data_lock) in\nath12k_mac_vdev_delete(), list_del() will detect the previously mentioned\nsituation, thereby triggering a kernel panic.\n\nThe fix is to remove and reinitialize all vif list nodes from the list head\n\"arvifs\" during WLAN halt. The reinitialization is to make the list nodes\nvalid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute\nnormally.\n\nCall trace:\n__list_del_entry_valid_or_report+0xd4/0x100 (P)\nath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k]\nath12k_scan_vdev_clean_work+0x40/0x164 [ath12k]\ncfg80211_wiphy_work+0xfc/0x100\nprocess_one_work+0x164/0x2d0\nworker_thread+0x254/0x380\nkthread+0xfc/0x100\nret_from_fork+0x10/0x20\n\nThe change is mostly copied from the ath11k patch:\nhttps://lore.kernel.org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.94", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "6.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:00.208Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38290", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:13.537Z", "dateReserved": "2025-04-16T04:51:24.001Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-10T07:42:06.259Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath12k/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "be049199dec9189602bc06e2c70eda3aa0f2ea6e", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git"}, {"lessThan": "6285516170f9e2f04b9dbf1e5100e0d7cbac22b4", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git"}, {"lessThan": "6bfe7ae9bbd9734751b853e2d2e1c13e8b46fd2d", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git"}, {"lessThan": "823435bd23108d6f8be89ea2d025c0e2e3769c51", "status": "affected", "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath12k/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.94", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.34", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F32A46D-A3D6-46B7-841B-D6FED06301AA", "versionEndExcluding": "6.6.94", "versionStartIncluding": "6.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FFA54AA-CDFE-4591-BD07-72813D0948F4", "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix node corruption in ar->arvifs list\n\nIn current WLAN recovery code flow, ath12k_core_halt() only reinitializes\nthe \"arvifs\" list head. This will cause the list node immediately following\nthe list head to become an invalid list node. Because the prev of that node\nstill points to the list head \"arvifs\", but the next of the list head\n\"arvifs\" no longer points to that list node.\n\nWhen a WLAN recovery occurs during the execution of a vif removal, and it\nhappens before the spin_lock_bh(&ar->data_lock) in\nath12k_mac_vdev_delete(), list_del() will detect the previously mentioned\nsituation, thereby triggering a kernel panic.\n\nThe fix is to remove and reinitialize all vif list nodes from the list head\n\"arvifs\" during WLAN halt. The reinitialization is to make the list nodes\nvalid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute\nnormally.\n\nCall trace:\n__list_del_entry_valid_or_report+0xd4/0x100 (P)\nath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k]\nath12k_scan_vdev_clean_work+0x40/0x164 [ath12k]\ncfg80211_wiphy_work+0xfc/0x100\nprocess_one_work+0x164/0x2d0\nworker_thread+0x254/0x380\nkthread+0xfc/0x100\nret_from_fork+0x10/0x20\n\nThe change is mostly copied from the ath11k patch:\nhttps://lore.kernel.org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: correcci\u00f3n de corrupci\u00f3n de nodos en la lista ar->arvifs. En el flujo de c\u00f3digo de recuperaci\u00f3n de WLAN actual, ath12k_core_halt() solo reinicializa la cabecera de lista \"arvifs\". Esto provocar\u00e1 que el nodo de lista inmediatamente posterior a la cabecera de lista se convierta en un nodo de lista inv\u00e1lido. Esto se debe a que el nodo anterior de ese nodo a\u00fan apunta a la cabecera de lista \"arvifs\", pero el siguiente ya no apunta a ese nodo. Cuando se produce una recuperaci\u00f3n de WLAN durante la ejecuci\u00f3n de una eliminaci\u00f3n de vif, y esto ocurre antes de spin_lock_bh(&ar->data_lock) en ath12k_mac_vdev_delete(), list_del() detectar\u00e1 la situaci\u00f3n mencionada anteriormente, lo que activar\u00e1 un p\u00e1nico del kernel. La soluci\u00f3n consiste en eliminar y reinicializar todos los nodos de lista vif de la cabecera de lista \"arvifs\" durante la detenci\u00f3n de WLAN. La reinicializaci\u00f3n valida los nodos de la lista, garantizando as\u00ed que list_del() en ath12k_mac_vdev_delete() pueda ejecutarse correctamente. Rastreo de llamadas: __list_del_entry_valid_or_report+0xd4/0x100 (P) ath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k] ath12k_scan_vdev_clean_work+0x40/0x164 [ath12k] cfg80211_wiphy_work+0xfc/0x100 process_one_work+0x164/0x2d0 worker_thread+0x254/0x380 kthread+0xfc/0x100 ret_from_fork+0x10/0x20 The change is mostly copied from the ath11k patch: https://lore.kernel.org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/ Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 "}], "id": "CVE-2025-38290", "lastModified": "2026-10-15T22:18:37.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38290", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:49:20.395606Z", "version": "2.0.3"}}]}, "published": "2025-07-10T08:15:27.583", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6285516170f9e2f04b9dbf1e5100e0d7cbac22b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6bfe7ae9bbd9734751b853e2d2e1c13e8b46fd2d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/823435bd23108d6f8be89ea2d025c0e2e3769c51"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be049199dec9189602bc06e2c70eda3aa0f2ea6e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-672"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: ath12k: fix node corruption in ar->arvifs list", "id": "2379201", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379201"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38290", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38290\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38290\nhttps://lore.kernel.org/linux-cve-announce/2025071011-CVE-2025-38290-36c3@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:06:39.088029+00:00", "updated": "2025-07-13T11:06:39.088130+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}