CVE-2025-22128

What it actually does

In error paths after MSI vector allocation for shared IRQs, the ath12k driver fails to clear the affinity hint before calling ath12k_pci_free_irq, triggering a WARN_ON_ONCE in the IRQ core that expects affinity_hint to be NULL.

Why it matters to the business

Low-severity kernel warning logs during certain initialization failures on affected wireless hardware; no direct service disruption or data exposure but adds noise to system logs and may complicate debugging on high-volume Red Hat Enterprise Linux deployments.

How an attack unfolds

An attacker would need local access to trigger a deliberate failure in IRQ request paths after MSI allocation; the bug itself only produces a warning and does not provide a direct path to privilege escalation or code execution.

How to fix it

Update the Linux kernel package containing the ath12k driver to a version that includes the fix clearing the affinity hint before ath12k_pci_free_irq in the error path; Red Hat users should apply the corresponding ruby package updates listed for rhel_eus:9.4 if the environment also consumes those components.

How to confirm the fix worked

After patching, reproduce the original error path and confirm that the WARN_ON_ONCE for a non-NULL affinity_hint no longer fires; inspect kernel source or dmesg for the absence of the warning string from irq/manage.c.

Typical attack path

1. Obtain local shell on a system using ath12k PCI wireless hardware with shared IRQs enabled
2. Force an error condition in one of the IRQ-requesting functions after ath12k_pci_msi_alloc has set the affinity hint
3. Observe the resulting kernel warning from irq/manage.c when ath12k_pci_free_irq is called without clearing the hint

How to detect it

Search kernel logs and dmesg for the warning string referencing affinity_hint from irq/manage.c around ath12k_pci_free_irq calls; no remote indicators exist.

What your security team should do

• Apply the kernel fix during the next scheduled maintenance window given the low EPSS and non-KEV status
• Monitor dmesg and kernel logs for the specific affinity_hint warning as a temporary detection measure until patched
• Prioritize systems with ath12k hardware that rely on shared IRQs due to platform constraints