CVE-2025-38293

What it actually does

The flaw leaves the arvifs list in an inconsistent state after ath11k_core_halt() reinitializes only the list head; subsequent list_del() in ath11k_mac_op_remove_interface() during concurrent vif removal detects the corruption and panics the kernel via __list_del_entry_valid_or_report.

Why it matters to the business

Systems using ath11k WiFi hardware can experience sudden kernel crashes and loss of wireless connectivity during recovery or interface teardown, disrupting operations on laptops, embedded devices, and servers; high Linux ecosystem prevalence amplifies exposure across many distributions.

How an attack unfolds

An attacker with the ability to trigger WLAN recovery (hardware events, driver reloads, or power-state changes) times an interface removal operation to race with the partial list reinitialization inside ath11k_core_halt(); the resulting invalid list node causes list_del() to panic. Related Linux kernel privilege-escalation campaigns have been observed chaining similar memory-corruption issues.

How to fix it

Upgrade linux-lts to 6.6.58-r0 or apply the stable kernel commit 6c139015b597e570dd5962934e9f9a2f4cc8ef48; rebuild and reboot with the corrected ath11k_core_halt() that removes and reinitializes every vif list node.

How to confirm the fix worked

Confirm the running kernel contains commit 6c139015b597e570dd5962934e9f9a2f4cc8ef48 or later; attempt interface removal during simulated recovery and verify no list corruption panic occurs.

Typical attack path

1. Trigger WLAN recovery path that calls ath11k_core_halt()
2. Initiate concurrent vif removal before data_lock is acquired
3. list_del() encounters corrupted prev/next pointers
4. Kernel panics with __list_del_entry_valid_or_report

How to detect it

Search kernel logs and crash dumps for the call trace containing __list_del_entry_valid_or_report followed by ath11k_mac_op_remove_interface and ieee80211_do_stop; correlate with preceding ath11k recovery or halt messages.

What your security team should do

• Apply the listed fixed kernel versions immediately on all ath11k-equipped hosts
• Prioritize systems exposed to wireless interface churn or frequent suspend/resume
• Add kernel-panic monitoring for ath11k list-del signatures until patches are deployed