CVE-2025-37944: wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Fix invalid entry fetch in ath12kdpmonsrngprocess
Currently, ath12kdpmonsrngprocess uses ath12khalsrngsrcgetnextentry to fetch the next entry from the destination ring. This is incorrect because ath12khalsrngsrcgetnextentry is intended for source rings, not destination rings. This leads to invalid entry fetches, causing potential data corruption or crashes due to accessing incorrect memory locations. This happens because the source ring and destination ring have different handling mechanisms and using the wrong function results in incorrect pointer arithmetic and ring management.
To fix this issue, replace the call to ath12khalsrngsrcgetnextentry with ath12khalsrngdstgetnextentry in ath12kdpmonsrngprocess. This ensures that the correct function is used for fetching entries from the destination ring, preventing invalid memory accesses.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPLSILICONZ-1 Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPLV1.0V2.0SILICONZ-3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ath12k_dp_mon_srng_process, replace the call to ath12k_hal_srng_src_get_next_entry with ath12k_hal_srng_dst_get_next_entry to ensure next-entry fetching uses the destination ring handling and prevents crashes/invalid memory accesses.
Linux kernel (wifi: ath12k) ath12k_dp_mon_srng_process: entry fetch function = Replace ath12k_hal_srng_src_get_next_entry with ath12k_hal_srng_dst_get_next_entry
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37944?
The severity of CVE-2025-37944 has not been explicitly assigned, but it involves a critical vulnerability in the Linux kernel related to the ath12k driver.
How do I fix CVE-2025-37944?
To fix CVE-2025-37944, you should update to the latest version of the Linux kernel where this vulnerability has been resolved.
What component does CVE-2025-37944 affect?
CVE-2025-37944 specifically affects the ath12k driver in the Linux kernel.
What versions of the Linux kernel are affected by CVE-2025-37944?
All versions of the Linux kernel that include the vulnerable code in the ath12k driver are affected by CVE-2025-37944.
What is the nature of the vulnerability in CVE-2025-37944?
The vulnerability in CVE-2025-37944 involves an incorrect fetch of an invalid entry in the ath12k_dp_mon_srng_process.