CVE-2025-23133

What it actually does

Race condition in ath11k WiFi driver where ath11k_reg_update_chan_list executes before cfg80211 finishes processing the new channel list during asynchronous reg_work, resulting in slab-out-of-bounds write.

Why it matters to the business

Kernel memory corruption on affected wireless systems can cause crashes, instability, or potential privilege escalation; high ecosystem prevalence of Linux kernel increases widespread exposure risk, with CISA KEV status absent but rising EPSS trend indicating growing exploit likelihood.

How an attack unfolds

Attacker induces a regulatory domain update to queue reg_work; the driver immediately calls into firmware update without waiting for cfg80211 completion, triggering the out-of-bounds write. Related threat actor patterns from similar kernel privilege escalation CVEs demonstrate chaining potential for local elevation.

How to fix it

Apply kernel patches enabling NL80211_REGDOM_SET_BY_DRIVER flag; for listed packages update to ruby (Red Hat:rhel_aus:8.6::appstream): fixed in 0:2.5.9-111.module+el8.6.0+22644+99a75427 and equivalent fixed versions for all affected Ruby components.

How to confirm the fix worked

Confirm patch presence by checking for NL80211_REGDOM_SET_BY_DRIVER usage and absence of KASAN reports in ath11k_reg_update_chan_list; verify package versions match provided fixed releases.

Typical attack path

1. Trigger regulatory domain change or channel list update via driver
2. Exploit timing window before cfg80211 completes asynchronous handling
3. Execute ath11k_reg_update_chan_list leading to KASAN-detected OOB write
4. Leverage corruption for denial of service or further kernel exploitation

How to detect it

Search kernel logs for KASAN slab-out-of-bounds in ath11k_reg_update_chan_list or ath11k_regd_update_work; correlate with process_one_work entries and regulatory update events.

• BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list
• ath11k_reg_update_chan_list+0xbfe/0xfe0
• ath11k_regd_update_work+0x14/0x20

What your security team should do

• Prioritize kernel and listed package updates within 30 days given EPSS increase
• Monitor for regulatory domain change events in wireless drivers
• Test patched kernels on ath11k hardware before broad deployment
• Review similar race condition patterns in other kernel wireless code