CVE-2025-40131: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu()
In ath12kdpmonrxdelivermsdu(), peer lookup fails because rxcb->peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular RX descriptor path that typically sets rxcb->peerid. As a result, the peer is NULL, and linkid and linkvalid fields in the RX status are not populated. This leads to a WARNON in mac80211 when it receives data frame from an associated station with invalid linkid.
Fix this potential issue by using ppduinfo->peerid, which holds the correct peer id for the received frame. This ensures that the peer is correctly found and the associated link metadata is updated accordingly.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPLSILICONZ-1
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40131?
CVE-2025-40131 is classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2025-40131?
To fix CVE-2025-40131, update to the latest version of the Linux kernel where the vulnerability has been patched.
What impact does CVE-2025-40131 have on affected systems?
CVE-2025-40131 can lead to improper peer lookup functionality in monitor mode, potentially allowing for denial of service conditions.
Which versions of the Linux kernel are affected by CVE-2025-40131?
CVE-2025-40131 affects various versions of the Linux kernel that implement the ath12k Wi-Fi driver.
Is there a workaround for CVE-2025-40131 until a fix is applied?
No official workaround is recommended for CVE-2025-40131; applying the kernel update is the most effective mitigation.