CVE-2025-38601
NoneCVSS
—
EPSS
0.3%
Published
Aug 19, 2025
CISA due date
—
Cloudanix analysis
A bug in certain Wi-Fi drivers can cause computers to crash when recovering from a wireless hardware error, requiring a reboot to restore normal operation.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Failure to clear the per-list initialized flag during ath11k_hal_srng_deinit() leaves stale pointers after SRNG list destruction; subsequent ath11k_hal_dump_srng_stats() dereferences freed memory, producing a kernel page fault.
Why it matters to the business
Systems using affected ath11k Wi-Fi hardware experience kernel panics and failed crash recovery on resume, causing unplanned downtime and loss of wireless connectivity until the device is rebooted or the driver is reloaded.
How an attack unfolds
An attacker or environmental trigger causes firmware crash and recovery; ath11k_core_reconfigure_on_crash() calls deinit without resetting the initialized flag; later statistics dumping walks the freed SRNG structures, triggering a page fault and kernel oops.
How to fix it
Upgrade the Linux kernel to commit 3a6daae987a829534636fd85ed6f84d5f0ad7fa4 or later; for Chainguard images apply the packages fixed in 0.53.0-r0.
How to confirm the fix worked
Confirm the patched commit is present in the running kernel; reproduce a firmware crash followed by resume and verify no page fault occurs in ath11k_hal_dump_srng_stats().
Typical attack path
- Trigger firmware or MHI error leading to ath11k reset
- ath11k_hal_srng_deinit() destroys SRNG lists but leaves initialized flags set
- ath11k_hal_dump_srng_stats() is invoked on the stale lists
- Kernel dereferences freed memory and panics
How to detect it
Search kernel logs for repeated ath11k reset sequences followed by page-fault oops in ath11k_hal_dump_srng_stats; inspect dmesg or journalctl for SRNG deinit without subsequent flag clearing.
- ath11k_hal_dump_srng_stats+0x2b4
- BUG: unable to handle page fault for address
- failed to reconfigure driver on crash recovery
- ath11k_hal_srng_deinit
What your security team should do
- Prioritize kernel updates on systems with ath11k hardware within the next maintenance window
- Monitor for ath11k firmware crash and recovery events in kernel logs
- Test resume behavior after applying the fix on representative hardware
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. ath11k_pci 0000:01:00.0: Service connect timeout ath11k_pci 0000:01:00.0: failed to connect to HTT: -110 ath11k_pci 0000:01:00.0: failed to start core: -110 ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM ath11k_pci 0000:01:00.0: already resetting count 2 ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110 ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110 ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery [..] 2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit() which destroys srng lists. However, it does not reset per-list ->initialized flag. 3) Second ath11k_hal_dump_srng_stats() call sees stale ->initialized flag and attempts to dump srng stats: Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 66785ms before ath11k_pci 0000:01:00.0: group_id 1 14485062ms before ath11k_pci 0000:01:00.0: group_id 2 14485062ms before ath11k_pci 0000:01:00.0: group_id 3 14485062ms before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath11k_pci 0000:01:00.0: group_id 6 14485062ms before ath11k_pci 0000:01:00.0: group_id 7 66814ms before ath11k_pci 0000:01:00.0: group_id 8 68997ms before ath11k_pci 0000:01:00.0: group_id 9 67588ms before ath11k_pci 0000:01:00.0: group_id 10 69511ms before BUG: unable to handle page fault for address: ffffa007404eb010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 10022d067 PMD 100b01067 PTE 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k] Call Trace: <TASK> ? __die_body+0xae/0xb0 ? page_fault_oops+0x381/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k (HASH:6cea 4)] ath11k_qmi_driver_event_work+0xbd/0x1050 [ath11k (HASH:6cea 4)] worker_thread+0x389/0x930 kthread+0x149/0x170 Clear per-list ->initialized flag in ath11k_hal_srng_deinit().
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:14 | linux | 0 | No fix |
| Debian:14 | linux | 0 | 6.16.3-1 |
| Linux | Kernel | 5.7.0 | 5.10.241 |
| Mageia:9 | kernel | 0 | 6.6.105-1.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.105-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.1.10-10.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-86.mga9 |
| Mageia:9 | mageia-repos | 0 | 9-4.mga9 |
| Mageia:9 | meta-task | 0 | 9-4.mga9 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_15 | 0 | 1-150600.1.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_15 | 0 | 1-150600.13.3.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.70.1.150600.12.30.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.52.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.52.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.52.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.70.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.52.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.52.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.52.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.52.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.52.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.70.1.150600.12.30.2 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.52.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.52.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.52.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.52.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.52.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.52.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.70.1 |
| openSUSE:Leap 16.0 | dtb-aarch64 | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-64kb | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-default | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-default-base | 0 | 6.12.0-160000.6.1.160000.2.4 |
| openSUSE:Leap 16.0 | kernel-docs | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-kvmsmall | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-obs-build | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-obs-qa | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-rt | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-source | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-syms | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-zfcpdump | 0 | 6.12.0-160000.6.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux