CVE-2025-37943

What it actually does

Missing length sanity check in ath12k_dp_rx_h_undecap_nwifi allows hardware-supplied packets exceeding native Wi-Fi header maximum to trigger out-of-bounds reads/writes and memory corruption during DP_RX_DECAP_TYPE_NATIVE_WIFI processing.

Why it matters to the business

Affected Ubuntu Linux systems with Qualcomm ath12k Wi-Fi hardware face elevated risk of crashes, data corruption, or potential local privilege escalation; broad package footprint across LTS releases and moderate ecosystem prevalence increase patching urgency despite low EPSS.

How an attack unfolds

Attacker crafts 802.11 frames with oversized native Wi-Fi headers and delivers them to a vulnerable receiver; the ath12k driver skips validation, performs invalid header modification, and corrupts adjacent kernel memory, enabling follow-on attacks consistent with observed Advanced Spyware Campaign patterns and related kernel privilege-escalation techniques.

How to fix it

Upgrade to the listed fixed package versions for each distribution, for example linux 5.4.0-9.12 on Ubuntu 20.04 LTS, linux 4.15.0-1007.9 on Ubuntu 18.04 LTS, linux 4.4.0-2.16 on Ubuntu 16.04 LTS, and equivalent updates for linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oracle and related meta-packages.

How to confirm the fix worked

Confirm updated kernel versions match the fixed releases, review ath12k source for presence of the added length sanity check before SKB processing, and test Wi-Fi receive paths with boundary-case frames.

Typical attack path

1. Identify systems running vulnerable ath12k driver versions on affected Ubuntu kernels
2. Position within Wi-Fi range or compromise an upstream access point to inject frames
3. Transmit specially crafted packets exceeding maximum native Wi-Fi header length
4. Trigger undecap path to cause memory corruption and gain code execution or denial of service

How to detect it

Review kernel logs for ath12k receive path warnings or panics, inspect SKB handling around undecap native Wi-Fi functions, and correlate with unusual wireless frame sizes or memory corruption events on systems exposed to Advanced Spyware Campaign activity.

What your security team should do

• Apply kernel updates to the exact fixed versions on all affected Ubuntu LTS systems within the next maintenance window
• Prioritize hosts with ath12k hardware and exposure to untrusted Wi-Fi networks given listed threat actor activity
• Monitor EPSS trend and re-evaluate if score increases or new exploitation reports appear