CVE-2025-23133: wifi: ath11k: update channel list in reg notifier instead reg worker
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: update channel list in reg notifier instead reg worker
Currently when ath11k gets a new channel list, it will be processed according to the following steps: 1. update new channel list to cfg80211 and queue regwork. 2. cfg80211 handles new channel list during regwork. 3. update cfg80211's handled channel list to firmware by ath11kregupdatechanlist().
But ath11k will immediately execute step 3 after regwork is just queued. Since step 2 is asynchronous, cfg80211 may not have completed handling the new channel list, which may leading to an out-of-bounds write error: BUG: KASAN: slab-out-of-bounds in ath11kregupdatechanlist Call Trace: ath11kregupdatechanlist+0xbfe/0xfe0 [ath11k] kfree+0x109/0x3a0 ath11kregdupdate+0x1cf/0x350 [ath11k] ath11kregdupdatework+0x14/0x20 [ath11k] processonework+0xe35/0x14c0
Should ensure step 2 is completely done before executing step 3. Thus Wen raised patch[1]. When flag NL80211REGDOMSETBYDRIVER is set, cfg80211 will notify ath11k after step 2 is done.
So enable the flag NL80211REGDOMSETBYDRIVER then cfg80211 will notify ath11k after step 2 is done. At this time, there will be no KASAN bug during the execution of the step 3.
[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quicwgong@quicinc.com/
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPLV1V2SILICONZLITE-3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux-wirelessto a version that resolves this vulnerability.Patch 20230201065313.27203-1-quic_wgong@quicinc.com/ - Configuration
Enable the NL80211_REGDOM_SET_BY_DRIVER flag so cfg80211 will notify ath11k only after step 2 is completely done (step 3 then runs safely), instead of ath11k processing the new channel list during reg_work asynchronously.
cfg80211 (NL80211_REGDOM_SET_BY_DRIVER) NL80211_REGDOM_SET_BY_DRIVER = set/enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23133?
The severity of CVE-2025-23133 has not been explicitly rated but it addresses new channel list handling in the Linux kernel.
How do I fix CVE-2025-23133?
To fix CVE-2025-23133, update your Linux kernel to the latest version where this vulnerability has been resolved.
What systems are affected by CVE-2025-23133?
CVE-2025-23133 affects the Linux kernel and Qualcomm WCN6855 firmware.
What does CVE-2025-23133 exploit?
CVE-2025-23133 exploits vulnerabilities related to channel list updates in the ath11k driver within the Linux kernel.
Is CVE-2025-23133 currently being exploited in the wild?
There is no current information indicating that CVE-2025-23133 is being actively exploited in the wild.