cbcvebase.
CVE-2025-38601
published 2025-08-19

CVE-2025-38601: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see…

medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. ath11k_pci 0000:01:00.0: Service connect timeout ath11k_pci 0000:01:00.0: failed to connect to HTT: -110 ath11k_pci 0000:01:00.0: failed to start core: -110 ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM ath11k_pci 0000:01:00.0: already resetting count 2 ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110 ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110 ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery [..] 2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit() which destroys srng lists. However, it does not reset per-list ->initialized flag. 3) Second ath11k_hal_dump_srng_stats() call sees stale ->initialized flag and attempts to dump srng stats: Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 66785ms before ath11k_pci 0000:01:00.0: group_id 1 14485062ms before ath11k_pci 0000:01:00.0: group_id 2 14485062ms before ath11k_pci 0000:01:00.0: group_id 3 14485062ms before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath11k_pci 0000:01:00.0: group_id 6 14485062ms before ath11k_pci 0000:01:00.0: group_id 7 66814ms before ath11k_pci 0000:01:00.0: group_id 8 68997ms before ath11k_pci 0000:01:00.0: group_id 9 67588ms before ath11k_pci 0000:01:00.0: group_id 10 69511ms before BUG: unable to handle page fault for

Affected

37 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.148-1 (bookworm)linux 6.1.148-1 (bookworm)
debianlinux-6.1< linux 6.1.148-1 (bookworm)linux 6.1.148-1 (bookworm)
linuxlinux
linuxlinux>= 5118935b1bc28d0bce9427e584e11e905e68ee9a < 3a6daae987a829534636fd85ed6f84d5f0ad7fa43a6daae987a829534636fd85ed6f84d5f0ad7fa4
linuxlinux>= 5118935b1bc28d0bce9427e584e11e905e68ee9a < eff3bb53c18c0ed4ab6f43d412b3ed3aecad52d5eff3bb53c18c0ed4ab6f43d412b3ed3aecad52d5
linuxlinux>= 5118935b1bc28d0bce9427e584e11e905e68ee9a < 916ac18d526a26f6072866b1a97622cf1351ef1c916ac18d526a26f6072866b1a97622cf1351ef1c
linuxlinux>= 5118935b1bc28d0bce9427e584e11e905e68ee9a < 5bf201c55fdf303e79005038648dfa1e8af48f545bf201c55fdf303e79005038648dfa1e8af48f54
linuxlinux>= 5118935b1bc28d0bce9427e584e11e905e68ee9a < 72a48be1f53942793f3bc68a37fad1f38b53b08272a48be1f53942793f3bc68a37fad1f38b53b082
linuxlinux>= 5118935b1bc28d0bce9427e584e11e905e68ee9a < 0ebb5fe494501c19f31270008b26ab95201af6fd0ebb5fe494501c19f31270008b26ab95201af6fd
linuxlinux>= 5118935b1bc28d0bce9427e584e11e905e68ee9a < 16872194c80f2724472fc207991712895ac8a23016872194c80f2724472fc207991712895ac8a230
linuxlinux>= 5118935b1bc28d0bce9427e584e11e905e68ee9a < a5b46aa7cf5f05c213316a018e49a8e086efd98ea5b46aa7cf5f05c213316a018e49a8e086efd98e
linuxlinux_kernel>= 0 < 5.10.244-15.10.244-1
linuxlinux_kernel>= 0 < 6.1.148-16.1.148-1
linuxlinux_kernel>= 0 < 6.12.43-16.12.43-1
linuxlinux_kernel>= 0 < 6.16.3-16.16.3-1
linuxlinux_kernel>= 0 < 5.15.0-163.1735.15.0-163.173
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 5.11 < 5.15.1905.15.190
linuxlinux_kernel>= 5.16 < 6.1.1486.1.148
linuxlinux_kernel>= 5.7 < 5.10.2415.10.241
linuxlinux_kernel>= 6.13 < 6.15.106.15.10
linuxlinux_kernel>= 6.16 < 6.16.16.16.1
linuxlinux_kernel>= 6.2 < 6.6.1026.6.102
linuxlinux_kernel>= 6.7 < 6.12.426.12.42

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM