CVE-2025-39746

What it actually does

The ath10k driver fails to detect repeated consecutive hardware restart failures after PCIe bus disconnection, allowing watchdog timeouts during resume that trigger kernel panics via dpm_watchdog_handler.

Why it matters to the business

Systems using affected wireless hardware may experience unexpected crashes and downtime during power management events, disrupting operations on Linux-based devices and servers.

How an attack unfolds

An attacker or environmental factor induces rare PCIe disconnection on ath10k hardware; the driver repeatedly attempts restarts without success, exceeding implicit thresholds and causing system-wide panic during resume operations. Threat actors such as VMSCAPE and campaigns targeting Linux kernel privilege escalation on container-optimized OS may combine this with other issues for amplified denial of service.

How to fix it

Update the Linux kernel to the fixed commit 201c9b4485edc618863a60f97a2d88bddd139467 or later stable versions containing the threshold check for fail_cont_count and pending_recovery atomic variables; disable ath10k if hardware instability is observed.

How to confirm the fix worked

Confirm kernel source contains the shutdown logic for unreliable hardware; reproduce by simulating repeated restart failures and verify no panic occurs; check dmesg for absence of DPM device timeout after the change.

Typical attack path

1. Induce or wait for ath10k PCIe bus disconnection
2. Trigger repeated WMI command timeouts and hardware restart attempts
3. Allow consecutive restart failures to exceed threshold
4. Force system resume to activate watchdog timeout and panic

How to detect it

Search kernel logs and dmesg for sequences of ath10k_pci WMI command timeouts, 'already restarting', 'failed to stop WMI vdev', and 'DPM device timeout' messages around resume events; correlate with Call Trace involving dpm_watchdog_handler.

• ath10k_pci 0000:01:00.0: wmi command 20486 timeout, restarting hardware
• ath10k_pci 0000:01:00.0: already restarting
• ath10k_pci 0000:01:00.0: failed to stop WMI vdev 0: -11
• ieee80211 phy0: PM: **** DPM device timeout ****
• panic+0x125/0x315 dpm_watchdog_set

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems using ath10k QCA6174 or similar hardware
• Monitor for ath10k restart loops in production environments
• Consider hardware replacement for devices showing frequent PCIe instability