UBUNTU-CVE-2025-38605: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12kdptxgetencaptype() In ath12kdptxgetencaptype(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kernel panic. Since the caller ath12kdptx() already has a valid ab pointer, pass it directly to avoid panic and unnecessary dereferencing. PC points to "ath12kdptx+0x228/0x988 [ath12k]" LR points to "ath12kdptx+0xc8/0x988 [ath12k]". The Backtrace obtained is as follows: ath12kdptx+0x228/0x988 [ath12k] ath12kmactxcheckmaxlimit+0x608/0x920 [ath12k] ieee80211processmeasurementreq+0x320/0x348 [mac80211] ieee80211txdequeue+0x9ac/0x1518 [mac80211] ieee80211txdequeue+0xb14/0x1518 [mac80211] ieee80211txprepareskb+0x224/0x254 [mac80211] ieee80211xmit+0xec/0x100 [mac80211] ieee80211subifstartxmit+0xc50/0xf40 [mac80211] ieee80211subifstartxmit+0x2e8/0x308 [mac80211] netdevstartxmit+0x150/0x18c devhardstartxmit+0x74/0xc0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPLSILICONZ-1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1020.21~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-36.36.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16~24.04.1 - Compensating control
Modify ath12k_dp_tx_get_encap_type() to accept and use the ab pointer directly from ath12k_dp_tx(), instead of dereferencing arvif to retrieve ab, preventing a NULL arvif->ar dereference during vdev deletion.