CVE-2025-38601

wifi: ath11k: clear initialized flag for deinit-ed srng lists

State: Published
Severity: 8.8 High
Published: Aug 19, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: clear initialized flag for deinit-ed srng lists

In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances:

1) First ath11k_hal_dump_srng_stats() call

Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. ath11k_pci 0000:01:00.0: Service connect timeout ath11k_pci 0000:01:00.0: failed to connect to HTT: -110 ath11k_pci 0000:01:00.0: failed to start core: -110 ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM ath11k_pci 0000:01:00.0: already resetting count 2 ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110 ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110 ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery [..]

2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit() which destroys srng lists. However, it does not reset per-list ->initialized flag.

3) Second ath11k_hal_dump_srng_stats() call sees stale ->initialized flag and attempts to dump srng stats:

Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 66785ms before ath11k_pci 0000:01:00.0: group_id 1 14485062ms before ath11k_pci 0000:01:00.0: group_id 2 14485062ms before ath11k_pci 0000:01:00.0: group_id 3 14485062ms before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath11k_pci 0000:01:00.0: group_id 6 14485062ms before ath11k_pci 0000:01:00.0: group_id 7 66814ms before ath11k_pci 0000:01:00.0: group_id 8 68997ms before ath11k_pci 0000:01:00.0: group_id 9 67588ms before ath11k_pci 0000:01:00.0: group_id 10 69511ms before BUG: unable to handle page fault for address: ffffa007404eb010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 10022d067 PMD 100b01067 PTE 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k] Call Trace: <TASK> ? __die_body+0xae/0xb0 ? page_fault_oops+0x381/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k (HASH:6cea 4)] ath11k_qmi_driver_event_work+0xbd/0x1050 [ath11k (HASH:6cea 4)] worker_thread+0x389/0x930 kthread+0x149/0x170

Clear per-list ->initialized flag in ath11k_hal_srng_deinit().

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5118935b1bc28d0bce9427e584e11e905e68ee9a to before 3a6daae987a829534636fd85ed6f84d5f0ad7fa4Affected 5118935b1bc28d0bce9427e584e11e905e68ee9a to before eff3bb53c18c0ed4ab6f43d412b3ed3aecad52d5Affected 5118935b1bc28d0bce9427e584e11e905e68ee9a to before 916ac18d526a26f6072866b1a97622cf1351ef1cAffected 5118935b1bc28d0bce9427e584e11e905e68ee9a to before 5bf201c55fdf303e79005038648dfa1e8af48f54Affected 5118935b1bc28d0bce9427e584e11e905e68ee9a to before 72a48be1f53942793f3bc68a37fad1f38b53b082Affected 5118935b1bc28d0bce9427e584e11e905e68ee9a to before 0ebb5fe494501c19f31270008b26ab95201af6fdAffected 5118935b1bc28d0bce9427e584e11e905e68ee9a to before 16872194c80f2724472fc207991712895ac8a230Affected 5118935b1bc28d0bce9427e584e11e905e68ee9a to before a5b46aa7cf5f05c213316a018e49a8e086efd98eAffected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.241 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.148 through 6.1.Not affected 6.6.102 through 6.6.Not affected 6.12.42 through 6.12.Not affected 6.15.10 through 6.15.Not affected 6.16.1 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

5118935b1bc28d0bce9427e584e11e905e68ee9a to before 3a6daae987a829534636fd85ed6f84d5f0ad7fa4Affected
5118935b1bc28d0bce9427e584e11e905e68ee9a to before eff3bb53c18c0ed4ab6f43d412b3ed3aecad52d5Affected
5118935b1bc28d0bce9427e584e11e905e68ee9a to before 916ac18d526a26f6072866b1a97622cf1351ef1cAffected
5118935b1bc28d0bce9427e584e11e905e68ee9a to before 5bf201c55fdf303e79005038648dfa1e8af48f54Affected
5118935b1bc28d0bce9427e584e11e905e68ee9a to before 72a48be1f53942793f3bc68a37fad1f38b53b082Affected
5118935b1bc28d0bce9427e584e11e905e68ee9a to before 0ebb5fe494501c19f31270008b26ab95201af6fdAffected
5118935b1bc28d0bce9427e584e11e905e68ee9a to before 16872194c80f2724472fc207991712895ac8a230Affected
5118935b1bc28d0bce9427e584e11e905e68ee9a to before a5b46aa7cf5f05c213316a018e49a8e086efd98eAffected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.241 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.148 through 6.1.*Not affected
6.6.102 through 6.6.*Not affected
6.12.42 through 6.12.*Not affected
6.15.10 through 6.15.*Not affected
6.16.1 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.