In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Fix invalid data access in ath12kdprxhundecap_nwifi
In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields in the header within the ath12kdprxhundecapnwifi function for DPRXDECAPTYPENATIVEWIFI decap type and potentially resulting in invalid data access and memory corruption.
Add a sanity check before processing the SKB to prevent invalid data access in the undecap native Wi-Fi function for the DPRXDECAPTYPENATIVE_WIFI decap type.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
[
{
"id": "CVE-2025-37943-024c3e0d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_null_q_desc"
},
"digest": {
"function_hash": "137723654067327440643570267714733483516",
"length": 1022.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3abe15e756481c45f6acba3d476cb3ca4afc3b61"
},
{
"id": "CVE-2025-37943-07165ea6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_process_msdu"
},
"digest": {
"function_hash": "63979585567648002849945703020059122900",
"length": 1419.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50be1fb76556e80af9f5da80f28168b6c71bce58"
},
{
"id": "CVE-2025-37943-0d01d16f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_null_q_desc"
},
"digest": {
"function_hash": "137723654067327440643570267714733483516",
"length": 1022.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ee653194ddb83674913fd2727b8ecfae0597ade"
},
{
"id": "CVE-2025-37943-10e00325",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_verify_tkip_mic"
},
"digest": {
"function_hash": "272492725691369600796042271742537045566",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3abe15e756481c45f6acba3d476cb3ca4afc3b61"
},
{
"id": "CVE-2025-37943-1d8f20a4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_tkip_mic_err"
},
"digest": {
"function_hash": "152411296432289919571652845951673680996",
"length": 682.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a0dddfb30f120db3851627935851d262e4e7acb"
},
{
"id": "CVE-2025-37943-1f701895",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c"
},
"digest": {
"line_hashes": [
"275178817556867227764342654181812163334",
"41135820850482194538718191099623016472",
"31597284907481819265348146095201642669",
"120166624923914320213758401141236459279",
"10791238528690092605400932804845782832",
"138145177141070368195516673894200317774",
"276930727333872450035482262047267882945",
"276824071366681104763675081237844506611",
"137820429436379922934960994839063352211",
"302692864046789399790444191000299288586",
"33568206605610850780201902159812524691",
"98810971897169242270342639987665227919",
"43888532283878834944477394419290178603",
"135073325712993533548083154786432713973",
"284295307727736647608337873185236630421",
"109594063275150125063907719057094051883",
"159991521469351541490718860977154187989",
"13380473955855972964409581093162117736",
"9752144019739725613151101887831269482",
"256675364477667299700759169580110385750",
"57498093874990566939495299776319644619",
"41006046748701808773177998037793628251",
"218297446753894010835505585920988646989",
"298584829437401627313898603102573099962",
"324162449317131053575982876731522522794",
"224830389923387668300441077520038847196",
"170808397242097112209635460313904077088",
"290106124571839596338972183325887040134"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50be1fb76556e80af9f5da80f28168b6c71bce58"
},
{
"id": "CVE-2025-37943-217937cd",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_process_msdu"
},
"digest": {
"function_hash": "278988155528211794575313455097356355536",
"length": 1426.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c"
},
{
"id": "CVE-2025-37943-2531d74e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_tkip_mic_err"
},
"digest": {
"function_hash": "12248924921363252162425635881170218634",
"length": 689.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c"
},
{
"id": "CVE-2025-37943-3439e369",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_verify_tkip_mic"
},
"digest": {
"function_hash": "272492725691369600796042271742537045566",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a0dddfb30f120db3851627935851d262e4e7acb"
},
{
"id": "CVE-2025-37943-3b057246",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_rxdma_err"
},
"digest": {
"function_hash": "76907681897401166770227038565749821843",
"length": 584.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50be1fb76556e80af9f5da80f28168b6c71bce58"
},
{
"id": "CVE-2025-37943-413345e8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_rxdma_err"
},
"digest": {
"function_hash": "76907681897401166770227038565749821843",
"length": 584.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c"
},
{
"id": "CVE-2025-37943-4226fdaf",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_verify_tkip_mic"
},
"digest": {
"function_hash": "272492725691369600796042271742537045566",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ee653194ddb83674913fd2727b8ecfae0597ade"
},
{
"id": "CVE-2025-37943-4bb53b0b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c"
},
"digest": {
"line_hashes": [
"103697317671625487821393743306545619454",
"66432530595779335403938060006449076505",
"31597284907481819265348146095201642669",
"120166624923914320213758401141236459279",
"10791238528690092605400932804845782832",
"138145177141070368195516673894200317774",
"276930727333872450035482262047267882945",
"276824071366681104763675081237844506611",
"137820429436379922934960994839063352211",
"302692864046789399790444191000299288586",
"33568206605610850780201902159812524691",
"98810971897169242270342639987665227919",
"43888532283878834944477394419290178603",
"135073325712993533548083154786432713973",
"284295307727736647608337873185236630421",
"109594063275150125063907719057094051883",
"159991521469351541490718860977154187989",
"13380473955855972964409581093162117736",
"9752144019739725613151101887831269482",
"256675364477667299700759169580110385750",
"57498093874990566939495299776319644619",
"41006046748701808773177998037793628251",
"218297446753894010835505585920988646989",
"298584829437401627313898603102573099962",
"324162449317131053575982876731522522794",
"224830389923387668300441077520038847196",
"170808397242097112209635460313904077088",
"290106124571839596338972183325887040134"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c"
},
{
"id": "CVE-2025-37943-7c2bff0a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_rxdma_err"
},
"digest": {
"function_hash": "76907681897401166770227038565749821843",
"length": 584.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3abe15e756481c45f6acba3d476cb3ca4afc3b61"
},
{
"id": "CVE-2025-37943-7c35c625",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_rxdma_err"
},
"digest": {
"function_hash": "76907681897401166770227038565749821843",
"length": 584.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ee653194ddb83674913fd2727b8ecfae0597ade"
},
{
"id": "CVE-2025-37943-8178aee6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_tkip_mic_err"
},
"digest": {
"function_hash": "152411296432289919571652845951673680996",
"length": 682.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50be1fb76556e80af9f5da80f28168b6c71bce58"
},
{
"id": "CVE-2025-37943-9b5c5675",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_verify_tkip_mic"
},
"digest": {
"function_hash": "272492725691369600796042271742537045566",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50be1fb76556e80af9f5da80f28168b6c71bce58"
},
{
"id": "CVE-2025-37943-a3788c30",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_process_msdu"
},
"digest": {
"function_hash": "63979585567648002849945703020059122900",
"length": 1419.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a0dddfb30f120db3851627935851d262e4e7acb"
},
{
"id": "CVE-2025-37943-a47b4c64",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_tkip_mic_err"
},
"digest": {
"function_hash": "152411296432289919571652845951673680996",
"length": 682.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3abe15e756481c45f6acba3d476cb3ca4afc3b61"
},
{
"id": "CVE-2025-37943-ab9f9a44",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_process_msdu"
},
"digest": {
"function_hash": "63979585567648002849945703020059122900",
"length": 1419.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3abe15e756481c45f6acba3d476cb3ca4afc3b61"
},
{
"id": "CVE-2025-37943-b34cf698",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c"
},
"digest": {
"line_hashes": [
"275178817556867227764342654181812163334",
"41135820850482194538718191099623016472",
"31597284907481819265348146095201642669",
"120166624923914320213758401141236459279",
"10791238528690092605400932804845782832",
"138145177141070368195516673894200317774",
"276930727333872450035482262047267882945",
"276824071366681104763675081237844506611",
"137820429436379922934960994839063352211",
"302692864046789399790444191000299288586",
"33568206605610850780201902159812524691",
"98810971897169242270342639987665227919",
"43888532283878834944477394419290178603",
"135073325712993533548083154786432713973",
"284295307727736647608337873185236630421",
"109594063275150125063907719057094051883",
"159991521469351541490718860977154187989",
"13380473955855972964409581093162117736",
"9752144019739725613151101887831269482",
"256675364477667299700759169580110385750",
"57498093874990566939495299776319644619",
"41006046748701808773177998037793628251",
"218297446753894010835505585920988646989",
"298584829437401627313898603102573099962",
"324162449317131053575982876731522522794",
"224830389923387668300441077520038847196",
"170808397242097112209635460313904077088",
"290106124571839596338972183325887040134"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ee653194ddb83674913fd2727b8ecfae0597ade"
},
{
"id": "CVE-2025-37943-bd32e2d8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_verify_tkip_mic"
},
"digest": {
"function_hash": "211997894477323947186330824890465866464",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c"
},
{
"id": "CVE-2025-37943-c18a6917",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c"
},
"digest": {
"line_hashes": [
"275178817556867227764342654181812163334",
"41135820850482194538718191099623016472",
"31597284907481819265348146095201642669",
"120166624923914320213758401141236459279",
"10791238528690092605400932804845782832",
"138145177141070368195516673894200317774",
"276930727333872450035482262047267882945",
"276824071366681104763675081237844506611",
"137820429436379922934960994839063352211",
"302692864046789399790444191000299288586",
"33568206605610850780201902159812524691",
"98810971897169242270342639987665227919",
"43888532283878834944477394419290178603",
"135073325712993533548083154786432713973",
"284295307727736647608337873185236630421",
"109594063275150125063907719057094051883",
"159991521469351541490718860977154187989",
"13380473955855972964409581093162117736",
"9752144019739725613151101887831269482",
"256675364477667299700759169580110385750",
"57498093874990566939495299776319644619",
"41006046748701808773177998037793628251",
"218297446753894010835505585920988646989",
"298584829437401627313898603102573099962",
"324162449317131053575982876731522522794",
"224830389923387668300441077520038847196",
"170808397242097112209635460313904077088",
"290106124571839596338972183325887040134"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a0dddfb30f120db3851627935851d262e4e7acb"
},
{
"id": "CVE-2025-37943-cb867517",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_process_msdu"
},
"digest": {
"function_hash": "63979585567648002849945703020059122900",
"length": 1419.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ee653194ddb83674913fd2727b8ecfae0597ade"
},
{
"id": "CVE-2025-37943-ce5b81e6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_rxdma_err"
},
"digest": {
"function_hash": "76907681897401166770227038565749821843",
"length": 584.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a0dddfb30f120db3851627935851d262e4e7acb"
},
{
"id": "CVE-2025-37943-ded7b289",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_tkip_mic_err"
},
"digest": {
"function_hash": "152411296432289919571652845951673680996",
"length": 682.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ee653194ddb83674913fd2727b8ecfae0597ade"
},
{
"id": "CVE-2025-37943-e06705d7",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c"
},
"digest": {
"line_hashes": [
"275178817556867227764342654181812163334",
"41135820850482194538718191099623016472",
"31597284907481819265348146095201642669",
"120166624923914320213758401141236459279",
"10791238528690092605400932804845782832",
"138145177141070368195516673894200317774",
"276930727333872450035482262047267882945",
"276824071366681104763675081237844506611",
"137820429436379922934960994839063352211",
"302692864046789399790444191000299288586",
"33568206605610850780201902159812524691",
"98810971897169242270342639987665227919",
"43888532283878834944477394419290178603",
"135073325712993533548083154786432713973",
"284295307727736647608337873185236630421",
"109594063275150125063907719057094051883",
"159991521469351541490718860977154187989",
"13380473955855972964409581093162117736",
"9752144019739725613151101887831269482",
"256675364477667299700759169580110385750",
"57498093874990566939495299776319644619",
"41006046748701808773177998037793628251",
"218297446753894010835505585920988646989",
"298584829437401627313898603102573099962",
"324162449317131053575982876731522522794",
"224830389923387668300441077520038847196",
"170808397242097112209635460313904077088",
"290106124571839596338972183325887040134"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3abe15e756481c45f6acba3d476cb3ca4afc3b61"
},
{
"id": "CVE-2025-37943-ef84d974",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_null_q_desc"
},
"digest": {
"function_hash": "18729718720535829879933324077749851036",
"length": 1313.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c"
},
{
"id": "CVE-2025-37943-f15e8e5a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_null_q_desc"
},
"digest": {
"function_hash": "137723654067327440643570267714733483516",
"length": 1022.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a0dddfb30f120db3851627935851d262e4e7acb"
},
{
"id": "CVE-2025-37943-fd0b6298",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/ath/ath12k/dp_rx.c",
"function": "ath12k_dp_rx_h_null_q_desc"
},
"digest": {
"function_hash": "137723654067327440643570267714733483516",
"length": 1022.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50be1fb76556e80af9f5da80f28168b6c71bce58"
}
]