CVE-2025-37982

What it actually does

skb dequeued from tx_queue is leaked when wl1251_ps_elp_wakeup returns -ETIMEDOUT, preventing the buffer from being requeued or freed.

Why it matters to the business

Systems using the affected WiFi driver on older Ubuntu kernels may experience gradual memory exhaustion, leading to degraded performance or instability during prolonged wireless operation; low ecosystem prevalence on modern deployments reduces overall exposure.

How an attack unfolds

An attacker with local or wireless-adjacent access repeatedly triggers wl1251_ps_elp_wakeup timeouts during TX processing, causing the driver to leak skb buffers without requeuing them, eventually exhausting kernel memory.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.11.0-12.19 or 4.4.0-2.16, linux-aws 4.4.0-1002.2 or 4.4.0-1001.10, linux-lts-xenial 4.4.0-13.29~14.04.1, linux-kvm 4.4.0-1004.9, linux-aws-5.15 5.15.0-1073.79~20.04.1.

How to confirm the fix worked

Verify running kernel package version matches or exceeds the fixed releases for the installed Ubuntu variant; monitor for absence of skb leaks in wl1251_tx_work under simulated timeout conditions.

Typical attack path

1. Obtain access to trigger wireless TX operations on affected wl1251 hardware
2. Force repeated -ETIMEDOUT returns from wl1251_ps_elp_wakeup
3. Observe cumulative skb leaks from tx_queue
4. Continue until memory pressure causes system degradation

How to detect it

Review kernel logs for repeated wl1251_ps_elp_wakeup timeout messages correlated with increasing memory usage; inspect slabinfo or kmemleak reports for orphaned sk_buff objects originating from wl1251_tx_work.

What your security team should do

• Prioritize patching systems still running the listed vulnerable Ubuntu kernel variants
• Remove or disable wl1251 hardware where feasible on legacy deployments
• Monitor memory usage trends on any remaining affected hosts