CVE-2025-38293

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38293", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.001Z", "datePublished": "2025-07-10T07:42:08.230Z", "dateUpdated": "2026-10-15T21:52:13.813Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:03.363Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix node corruption in ar->arvifs list\n\nIn current WLAN recovery code flow, ath11k_core_halt() only\nreinitializes the \"arvifs\" list head. This will cause the\nlist node immediately following the list head to become an\ninvalid list node. Because the prev of that node still points\nto the list head \"arvifs\", but the next of the list head \"arvifs\"\nno longer points to that list node.\n\nWhen a WLAN recovery occurs during the execution of a vif\nremoval, and it happens before the spin_lock_bh(&ar->data_lock)\nin ath11k_mac_op_remove_interface(), list_del() will detect the\npreviously mentioned situation, thereby triggering a kernel panic.\n\nThe fix is to remove and reinitialize all vif list nodes from the\nlist head \"arvifs\" during WLAN halt. The reinitialization is to make\nthe list nodes valid, ensuring that the list_del() in\nath11k_mac_op_remove_interface() can execute normally.\n\nCall trace:\n__list_del_entry_valid_or_report+0xb8/0xd0\nath11k_mac_op_remove_interface+0xb0/0x27c [ath11k]\ndrv_remove_interface+0x48/0x194 [mac80211]\nieee80211_do_stop+0x6e0/0x844 [mac80211]\nieee80211_stop+0x44/0x17c [mac80211]\n__dev_close_many+0xac/0x150\n__dev_change_flags+0x194/0x234\ndev_change_flags+0x24/0x6c\ndevinet_ioctl+0x3a0/0x670\ninet_ioctl+0x200/0x248\nsock_do_ioctl+0x60/0x118\nsock_ioctl+0x274/0x35c\n__arm64_sys_ioctl+0xac/0xf0\ninvoke_syscall+0x48/0x114\n...\n\nTested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04591-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable code is in the ath11k Wi-Fi driver, and the triggering side of the race is a firmware crash/recovery (`MHI_CB_EE_RDDM` \u2192 `ab->reset_work`), which an attacker within radio range can induce with hostile/malformed 802.11 frames against QCA firmware. Exploitation therefore requires adjacency to the victim's WLAN, not routable network access.\nAC:L - `ath11k_core_halt()` runs from ath11k's own workqueue holding only `ar->conf_mutex`, while `ath11k_mac_op_remove_interface()` sits blocked in `cancel_work_sync()` and then on `conf_mutex` (held for seconds by timing-out WMI ops on crashed firmware), giving a very wide window; the attacker can force unlimited crash/recovery cycles, and each crash predictably causes the supplicant/WiFi framework to tear the interface down, so the attacker effectively drives both sides.\nPR:N - Inducing the firmware crash requires only transmitting frames in range \u2014 no credentials, association, or local account. The vif-removal side is performed automatically by system daemons (NetworkManager/wpa_supplicant/Android WiFi framework) reacting to the crash, not by a privileged attacker action.\nUI:N - No victim action is needed; the interface teardown that collides with recovery is an automated response by system daemons to the firmware crash the attacker induced.\nS:U - The list corruption and its consequences are confined to the kernel's own memory and security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:H - On kernels without list hardening the corrupted `list_del()` silently leaves `ar->arvifs` referencing `ath11k_vif` objects that are freed when the interface is destroyed; the ~20 iteration sites (WMI event handlers, regulatory update, spectral, WoW, TX paths) then read freed heap memory, yielding a use-after-free read primitive over attacker-groomable slab contents.\nI:H - `__list_del()` writes through the stale `prev`/`next` pointers, and a later `list_add(&arvif->list, &ar->arvifs)` writes a pointer into a freed object; combined with iteration that stores into dangling `arvif` fields, this is a use-after-free write primitive suitable for heap grooming and control-flow-relevant corruption.\nA:H - The commit documents a reproduced kernel panic via `__list_del_entry_valid_or_report` in `ath11k_mac_op_remove_interface`, and the attacker can repeat the crash/recovery cycle to re-trigger it, causing full denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/core.c"], "versions": [{"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "6c139015b597e570dd5962934e9f9a2f4cc8ef48", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f9507cf2dd0e1ed5028c0e8240da6fe5fd3110d3", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "b0974ed82e6ad5ff246fd90a5b14f3e7be4f2924", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f50ba7e7b607f2d00618799312e7fdb76a1ff48e", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f5d77d0d41ea7a204d47288d0cf0404a52b5890e", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "6d6cb27fe146061f2512e904618f5e005bb7bb6a", "status": "affected", "versionType": "git"}, {"version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "31e98e277ae47f56632e4d663b1d4fd12ba33ea8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath11k/core.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.239", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.186", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.94", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.239"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.186"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6c139015b597e570dd5962934e9f9a2f4cc8ef48"}, {"url": "https://git.kernel.org/stable/c/f9507cf2dd0e1ed5028c0e8240da6fe5fd3110d3"}, {"url": "https://git.kernel.org/stable/c/b0974ed82e6ad5ff246fd90a5b14f3e7be4f2924"}, {"url": "https://git.kernel.org/stable/c/f50ba7e7b607f2d00618799312e7fdb76a1ff48e"}, {"url": "https://git.kernel.org/stable/c/f5d77d0d41ea7a204d47288d0cf0404a52b5890e"}, {"url": "https://git.kernel.org/stable/c/6d6cb27fe146061f2512e904618f5e005bb7bb6a"}, {"url": "https://git.kernel.org/stable/c/31e98e277ae47f56632e4d663b1d4fd12ba33ea8"}], "title": "wifi: ath11k: fix node corruption in ar->arvifs list", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:36:17.536Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38293", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:49:26.154444Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:13.813Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:36:17.536Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38293", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:49:26.154444Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:49:27.067Z"}}], "cna": {"title": "wifi: ath11k: fix node corruption in ar->arvifs list", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable code is in the ath11k Wi-Fi driver, and the triggering side of the race is a firmware crash/recovery (`MHI_CB_EE_RDDM` \u2192 `ab->reset_work`), which an attacker within radio range can induce with hostile/malformed 802.11 frames against QCA firmware. Exploitation therefore requires adjacency to the victim's WLAN, not routable network access.\nAC:L - `ath11k_core_halt()` runs from ath11k's own workqueue holding only `ar->conf_mutex`, while `ath11k_mac_op_remove_interface()` sits blocked in `cancel_work_sync()` and then on `conf_mutex` (held for seconds by timing-out WMI ops on crashed firmware), giving a very wide window; the attacker can force unlimited crash/recovery cycles, and each crash predictably causes the supplicant/WiFi framework to tear the interface down, so the attacker effectively drives both sides.\nPR:N - Inducing the firmware crash requires only transmitting frames in range \u2014 no credentials, association, or local account. The vif-removal side is performed automatically by system daemons (NetworkManager/wpa_supplicant/Android WiFi framework) reacting to the crash, not by a privileged attacker action.\nUI:N - No victim action is needed; the interface teardown that collides with recovery is an automated response by system daemons to the firmware crash the attacker induced.\nS:U - The list corruption and its consequences are confined to the kernel's own memory and security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:H - On kernels without list hardening the corrupted `list_del()` silently leaves `ar->arvifs` referencing `ath11k_vif` objects that are freed when the interface is destroyed; the ~20 iteration sites (WMI event handlers, regulatory update, spectral, WoW, TX paths) then read freed heap memory, yielding a use-after-free read primitive over attacker-groomable slab contents.\nI:H - `__list_del()` writes through the stale `prev`/`next` pointers, and a later `list_add(&arvif->list, &ar->arvifs)` writes a pointer into a freed object; combined with iteration that stores into dangling `arvif` fields, this is a use-after-free write primitive suitable for heap grooming and control-flow-relevant corruption.\nA:H - The commit documents a reproduced kernel panic via `__list_del_entry_valid_or_report` in `ath11k_mac_op_remove_interface`, and the attacker can repeat the crash/recovery cycle to re-trigger it, causing full denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "6c139015b597e570dd5962934e9f9a2f4cc8ef48", "versionType": "git"}, {"status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f9507cf2dd0e1ed5028c0e8240da6fe5fd3110d3", "versionType": "git"}, {"status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "b0974ed82e6ad5ff246fd90a5b14f3e7be4f2924", "versionType": "git"}, {"status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f50ba7e7b607f2d00618799312e7fdb76a1ff48e", "versionType": "git"}, {"status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "f5d77d0d41ea7a204d47288d0cf0404a52b5890e", "versionType": "git"}, {"status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "6d6cb27fe146061f2512e904618f5e005bb7bb6a", "versionType": "git"}, {"status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "lessThan": "31e98e277ae47f56632e4d663b1d4fd12ba33ea8", "versionType": "git"}], "programFiles": ["drivers/net/wireless/ath/ath11k/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"status": "unaffected", "version": "0", "lessThan": "5.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.239", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.186", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.142", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.94", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.34", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.3", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/ath/ath11k/core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6c139015b597e570dd5962934e9f9a2f4cc8ef48"}, {"url": "https://git.kernel.org/stable/c/f9507cf2dd0e1ed5028c0e8240da6fe5fd3110d3"}, {"url": "https://git.kernel.org/stable/c/b0974ed82e6ad5ff246fd90a5b14f3e7be4f2924"}, {"url": "https://git.kernel.org/stable/c/f50ba7e7b607f2d00618799312e7fdb76a1ff48e"}, {"url": "https://git.kernel.org/stable/c/f5d77d0d41ea7a204d47288d0cf0404a52b5890e"}, {"url": "https://git.kernel.org/stable/c/6d6cb27fe146061f2512e904618f5e005bb7bb6a"}, {"url": "https://git.kernel.org/stable/c/31e98e277ae47f56632e4d663b1d4fd12ba33ea8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix node corruption in ar->arvifs list\n\nIn current WLAN recovery code flow, ath11k_core_halt() only\nreinitializes the \"arvifs\" list head. This will cause the\nlist node immediately following the list head to become an\ninvalid list node. Because the prev of that node still points\nto the list head \"arvifs\", but the next of the list head \"arvifs\"\nno longer points to that list node.\n\nWhen a WLAN recovery occurs during the execution of a vif\nremoval, and it happens before the spin_lock_bh(&ar->data_lock)\nin ath11k_mac_op_remove_interface(), list_del() will detect the\npreviously mentioned situation, thereby triggering a kernel panic.\n\nThe fix is to remove and reinitialize all vif list nodes from the\nlist head \"arvifs\" during WLAN halt. The reinitialization is to make\nthe list nodes valid, ensuring that the list_del() in\nath11k_mac_op_remove_interface() can execute normally.\n\nCall trace:\n__list_del_entry_valid_or_report+0xb8/0xd0\nath11k_mac_op_remove_interface+0xb0/0x27c [ath11k]\ndrv_remove_interface+0x48/0x194 [mac80211]\nieee80211_do_stop+0x6e0/0x844 [mac80211]\nieee80211_stop+0x44/0x17c [mac80211]\n__dev_close_many+0xac/0x150\n__dev_change_flags+0x194/0x234\ndev_change_flags+0x24/0x6c\ndevinet_ioctl+0x3a0/0x670\ninet_ioctl+0x200/0x248\nsock_do_ioctl+0x60/0x118\nsock_ioctl+0x274/0x35c\n__arm64_sys_ioctl+0xac/0xf0\ninvoke_syscall+0x48/0x114\n...\n\nTested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04591-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.239", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.186", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.142", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.94", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.34", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.3", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "5.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:03.363Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38293", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:13.813Z", "dateReserved": "2025-04-16T04:51:24.001Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-10T07:42:08.230Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6c139015b597e570dd5962934e9f9a2f4cc8ef48", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "f9507cf2dd0e1ed5028c0e8240da6fe5fd3110d3", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "b0974ed82e6ad5ff246fd90a5b14f3e7be4f2924", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "f50ba7e7b607f2d00618799312e7fdb76a1ff48e", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "f5d77d0d41ea7a204d47288d0cf0404a52b5890e", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "6d6cb27fe146061f2512e904618f5e005bb7bb6a", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}, {"lessThan": "31e98e277ae47f56632e4d663b1d4fd12ba33ea8", "status": "affected", "version": "d5c65159f2895379e11ca13f62feabe93278985d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath11k/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.239", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.186", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.142", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.94", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.34", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEBAE650-5B1E-46B1-8325-765BE565E942", "versionEndExcluding": "5.10.239", "versionStartIncluding": "5.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D96F2C0D-0D4A-4658-AD34-D8A626EA422D", "versionEndExcluding": "5.15.186", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "459B4E94-FE0E-434D-B782-95E3A5FFC6B1", "versionEndExcluding": "6.1.142", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "304E3F01-7D7A-4908-994E-7F95C5C00B06", "versionEndExcluding": "6.6.94", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FFA54AA-CDFE-4591-BD07-72813D0948F4", "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix node corruption in ar->arvifs list\n\nIn current WLAN recovery code flow, ath11k_core_halt() only\nreinitializes the \"arvifs\" list head. This will cause the\nlist node immediately following the list head to become an\ninvalid list node. Because the prev of that node still points\nto the list head \"arvifs\", but the next of the list head \"arvifs\"\nno longer points to that list node.\n\nWhen a WLAN recovery occurs during the execution of a vif\nremoval, and it happens before the spin_lock_bh(&ar->data_lock)\nin ath11k_mac_op_remove_interface(), list_del() will detect the\npreviously mentioned situation, thereby triggering a kernel panic.\n\nThe fix is to remove and reinitialize all vif list nodes from the\nlist head \"arvifs\" during WLAN halt. The reinitialization is to make\nthe list nodes valid, ensuring that the list_del() in\nath11k_mac_op_remove_interface() can execute normally.\n\nCall trace:\n__list_del_entry_valid_or_report+0xb8/0xd0\nath11k_mac_op_remove_interface+0xb0/0x27c [ath11k]\ndrv_remove_interface+0x48/0x194 [mac80211]\nieee80211_do_stop+0x6e0/0x844 [mac80211]\nieee80211_stop+0x44/0x17c [mac80211]\n__dev_close_many+0xac/0x150\n__dev_change_flags+0x194/0x234\ndev_change_flags+0x24/0x6c\ndevinet_ioctl+0x3a0/0x670\ninet_ioctl+0x200/0x248\nsock_do_ioctl+0x60/0x118\nsock_ioctl+0x274/0x35c\n__arm64_sys_ioctl+0xac/0xf0\ninvoke_syscall+0x48/0x114\n...\n\nTested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04591-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath11k: correcci\u00f3n de corrupci\u00f3n de nodos en la lista ar->arvifs. En el flujo de c\u00f3digo de recuperaci\u00f3n de WLAN actual, ath11k_core_halt() solo reinicializa la cabecera de lista \"arvifs\". Esto provocar\u00e1 que el nodo de lista inmediatamente posterior a la cabecera de lista se convierta en un nodo de lista inv\u00e1lido. Esto se debe a que el nodo anterior de ese nodo a\u00fan apunta a la cabecera de lista \"arvifs\", pero el siguiente ya no apunta a ese nodo. Cuando se produce una recuperaci\u00f3n de WLAN durante la ejecuci\u00f3n de una eliminaci\u00f3n de vif, y esto ocurre antes de spin_lock_bh(&ar->data_lock) en ath11k_mac_op_remove_interface(), list_del() detectar\u00e1 la situaci\u00f3n mencionada anteriormente, lo que activar\u00e1 un p\u00e1nico del kernel. La soluci\u00f3n consiste en eliminar y reinicializar todos los nodos de lista vif de la cabecera de lista \"arvifs\" durante la detenci\u00f3n de WLAN. La reinicializaci\u00f3n sirve para hacer que los nodos de la lista sean v\u00e1lidos, garantizando que list_del() en ath11k_mac_op_remove_interface() pueda ejecutarse normalmente. Rastreo de llamadas: __list_del_entry_valid_or_report+0xb8/0xd0 ath11k_mac_op_remove_interface+0xb0/0x27c [ath11k] drv_remove_interface+0x48/0x194 [mac80211] ieee80211_do_stop+0x6e0/0x844 [mac80211] ieee80211_stop+0x44/0x17c [mac80211] __dev_close_many+0xac/0x150 __dev_change_flags+0x194/0x234 dev_change_flags+0x24/0x6c devinet_ioctl+0x3a0/0x670 inet_ioctl+0x200/0x248 sock_do_ioctl+0x60/0x118 sock_ioctl+0x274/0x35c __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x48/0x114 ... Probado en: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04591-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1"}], "id": "CVE-2025-38293", "lastModified": "2026-10-15T22:18:38.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38293", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:49:26.154444Z", "version": "2.0.3"}}]}, "published": "2025-07-10T08:15:27.927", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/31e98e277ae47f56632e4d663b1d4fd12ba33ea8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6c139015b597e570dd5962934e9f9a2f4cc8ef48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6d6cb27fe146061f2512e904618f5e005bb7bb6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b0974ed82e6ad5ff246fd90a5b14f3e7be4f2924"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f50ba7e7b607f2d00618799312e7fdb76a1ff48e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f5d77d0d41ea7a204d47288d0cf0404a52b5890e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f9507cf2dd0e1ed5028c0e8240da6fe5fd3110d3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: ath11k: fix node corruption in ar->arvifs list", "id": "2379210", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379210"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38293", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38293\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38293\nhttps://lore.kernel.org/linux-cve-announce/2025071012-CVE-2025-38293-8e77@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:06:38.022107+00:00", "updated": "2025-07-13T11:06:38.022172+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel", "qualcomm", "qualcomm$PRODUCT$qca6698aq"]}