Cloudanix VulnDB

CVE-2025-37976

None

CVSS

—

EPSS

—

Published

May 20, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in Linux wireless networking code can cause computers to crash or corrupt data when handling certain network traffic.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect call to ath12k_hal_srng_src_get_next_entry on a destination ring instead of ath12k_hal_srng_dst_get_next_entry causes invalid pointer arithmetic and memory accesses in ath12k_dp_mon_srng_process.

Why it matters to the business

Wireless networking instability or crashes on affected Linux systems can interrupt connectivity and require restarts, increasing operational overhead especially on Ubuntu deployments with high downstream usage.

How an attack unfolds

An attacker sends crafted wireless traffic or triggers monitor ring processing in the ath12k driver, causing the wrong ring helper to fetch entries, resulting in invalid memory operations that may corrupt data or crash the kernel.

How to fix it

Upgrade libarchive packages to the listed fixed versions: Ubuntu 22.04 to 3.6.0-1ubuntu1.2, Ubuntu 24.04 to 3.7.2-2ubuntu0.2, Ubuntu 24.10 to 3.7.4-1. Reboot after kernel-related updates if applicable and verify the change replaces the flawed ath12k ring handling call.

How to confirm the fix worked

Confirm the updated source contains ath12k_hal_srng_dst_get_next_entry in ath12k_dp_mon_srng_process and test ring processing under load; check package versions match the fixed releases on each Ubuntu release.

Typical attack path

  1. Interact with ath12k wireless monitor functionality to invoke ath12k_dp_mon_srng_process
  2. Execute incorrect source-ring helper on destination ring
  3. Perform invalid pointer arithmetic during entry fetch
  4. Access out-of-bounds memory locations leading to corruption or crash

How to detect it

Search kernel logs for ath12k ring processing errors, crashes, or memory faults around wireless monitor ring activity; examine dmesg or syslog for invalid entry fetch messages post-2025-05-20.

What your security team should do

  • Apply the listed package updates immediately on all affected Ubuntu systems
  • Prioritize systems handling wireless traffic due to memory corruption risk
  • Monitor for post-update stability in ath12k driver operations
  • Review wireless configurations to reduce exposure until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process [ Upstream commit 63fdc4509bcf483e79548de6bc08bf3c8e504bb3 ] Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry to fetch the next entry from the destination ring. This is incorrect because ath12k_hal_srng_src_get_next_entry is intended for source rings, not destination rings. This leads to invalid entry fetches, causing potential data corruption or crashes due to accessing incorrect memory locations. This happens because the source ring and destination ring have different handling mechanisms and using the wrong function results in incorrect pointer arithmetic and ring management. To fix this issue, replace the call to ath12k_hal_srng_src_get_next_entry with ath12k_hal_srng_dst_get_next_entry in ath12k_dp_mon_srng_process. This ensures that the correct function is used for fetching entries from the destination ring, preventing invalid memory accesses. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 linux 0 No fix

Related vulnerabilities