CVE-2025-38605

What it actually does

Null pointer dereference in ath12k_dp_tx_get_encap_type() during vdev delete when arvif->ar becomes NULL, triggered from ath12k_dp_tx() and leading to kernel panic.

Why it matters to the business

Unexpected system crashes on affected Linux wireless devices can interrupt network operations and require reboots, with moderate urgency due to rising EPSS trend and mentions in container privilege-escalation contexts.

How an attack unfolds

An attacker with local network access or ability to trigger 802.11 TX operations initiates wireless traffic or measurement requests while a vdev delete sequence is in progress, causing the NULL dereference and crash; observed in contexts involving VMSCAPE and related Linux kernel container exploits.

How to fix it

Update to a kernel containing commit b508f370f88f277c95e2bd3bc47217a96d668cee or later; for listed packages apply the versions fixed in 0.53.0-r1 or equivalent stable releases.

How to confirm the fix worked

Verify the patch commit is present in the running kernel source; confirm absence of the NULL dereference path by reviewing ath12k_dp_tx() callers and test vdev delete under load.

Typical attack path

1. Initiate or manipulate 802.11 association or TX path
2. Trigger vdev delete sequence concurrently
3. Cause arvif->ar to be NULL during ath12k_dp_tx_get_encap_type() call
4. Trigger kernel panic via NULL dereference in ath12k_dp_tx()

How to detect it

Search kernel logs and crash dumps for ath12k backtraces involving ath12k_dp_tx and ieee80211_tx_dequeue; look for panic messages referencing QCN9274 or vdev delete sequences.

• ath12k_dp_tx+0x228/0x988 [ath12k]
• ath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k]
• ieee80211_process_measurement_req+0x320/0x348 [mac80211]
• PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]"
• LR points to "ath12k_dp_tx+0xc8/0x988 [ath12k]"

What your security team should do

• Prioritize kernel updates on systems using ath12k wireless drivers
• Monitor EPSS trend and container workload exposure
• Apply fixed versions for affected Chainguard and git-based packages immediately