CVE-2025-68729

What it actually does

Failure to free skb buffers for MSDU-type packets received on the REO exception ring from unassociated peers in ath12k_hal_desc_reo_parse_err causes memory leaks and potential kernel crashes due to unhandled buffer types.

Why it matters to the business

Kernel instability or crashes on systems using affected ath12k WiFi hardware can disrupt operations and availability; widespread presence in EKS distributions increases exposure across containerized environments.

How an attack unfolds

An attacker sends frames from an unassociated peer to trigger the REO exception ring path, delivering MSDU buffer type packets that the driver does not free, leading to leaks and crashes.

How to fix it

Upgrade to fixed kernel commit 5ff5a9d71cdc49c3400f30583a784ad0a17d01ec or package versions 1.32.9-r0 for all listed eks-distro components.

How to confirm the fix worked

Verify kernel or package version matches fixed releases; confirm absence of the vulnerable ath12k RX error path code via source inspection or runtime checks for buffer type handling.

Typical attack path

1. Locate target system using ath12k hardware
2. Transmit crafted frames from an unassociated station to hit the REO exception ring
3. Trigger MSDU buffer type handling without skb release
4. Cause repeated leaks or kernel panic via sustained invalid RX traffic

How to detect it

Search kernel logs for ath12k_hal_desc_reo_parse_err references, skb allocation warnings, or REO exception ring errors; correlate with unassociated peer RX events.

• ath12k_hal_desc_reo_parse_err
• MSDU buffer type
• REO exception ring

What your security team should do

• Apply fixed kernel and package versions immediately on all affected systems
• Prioritize patching for WiFi-enabled hosts in production EKS environments
• Monitor for ath12k-related kernel oops and memory pressure until updates are deployed