CVE-2025-38605

wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()

State: Published
Severity: Not scored
Published: Aug 19, 2025
Updated: Oct 21, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()

In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kernel panic. Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it directly to avoid panic and unnecessary dereferencing.

PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]" LR points to "ath12k_dp_tx+0xc8/0x988 [ath12k]". The Backtrace obtained is as follows: ath12k_dp_tx+0x228/0x988 [ath12k] ath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k] ieee80211_process_measurement_req+0x320/0x348 [mac80211] ieee80211_tx_dequeue+0x9ac/0x1518 [mac80211] ieee80211_tx_dequeue+0xb14/0x1518 [mac80211] ieee80211_tx_prepare_skb+0x224/0x254 [mac80211] ieee80211_xmit+0xec/0x100 [mac80211] __ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211] ieee80211_subif_start_xmit+0x2e8/0x308 [mac80211] netdev_start_xmit+0x150/0x18c dev_hard_start_xmit+0x74/0xc0

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e93bbd65547ea8073b707c9034c3f051f8018614 to before be27a11a42b2190f817b198bf5e753e5e4ac849eAffected e93bbd65547ea8073b707c9034c3f051f8018614 to before d9d2a0466e981d1be95fc8bdc05806ea21def758Affected e93bbd65547ea8073b707c9034c3f051f8018614 to before b508f370f88f277c95e2bd3bc47217a96d668ceeAffected e93bbd65547ea8073b707c9034c3f051f8018614 to before ee4f8e7fa578f9f28cef5f409677db25f4f83d7eAffected e93bbd65547ea8073b707c9034c3f051f8018614 to before 05062834350f0bf7ad1abcebc2807220e90220ebAffected
LinuxLinux	6.4Affected before 6.4Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.15.10 through 6.15.Not affected 6.16.1 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

e93bbd65547ea8073b707c9034c3f051f8018614 to before be27a11a42b2190f817b198bf5e753e5e4ac849eAffected
e93bbd65547ea8073b707c9034c3f051f8018614 to before d9d2a0466e981d1be95fc8bdc05806ea21def758Affected
e93bbd65547ea8073b707c9034c3f051f8018614 to before b508f370f88f277c95e2bd3bc47217a96d668ceeAffected
e93bbd65547ea8073b707c9034c3f051f8018614 to before ee4f8e7fa578f9f28cef5f409677db25f4f83d7eAffected
e93bbd65547ea8073b707c9034c3f051f8018614 to before 05062834350f0bf7ad1abcebc2807220e90220ebAffected

LinuxLinux

6.4Affected
before 6.4Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.15.10 through 6.15.*Not affected
6.16.1 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.