CVE-2025-38513

In the Linux kernel, the following vulnerability has been resolved:

wifi: zd1211rw: Fix potential NULL pointer dereference in zdmactxtodev()

There is a potential NULL pointer dereference in zdmactxtodev(). For example, the following is possible:

    T0                      T1

zdmactxtodev() /* len == skbqueuelen(q) */ while (len > ZDMACMAXACKWAITERS) {

                  filter_ack()
                    spin_lock_irqsave(&q->lock, flags);
                    /* position == skb_queue_len(q) */
                    for (i=1; i<position; i++)
                          skb = __skb_dequeue(q)

                    if (mac->type == NL80211_IFTYPE_AP)
                      skb = __skb_dequeue(q);
                    spin_unlock_irqrestore(&q->lock, flags);

skb_dequeue() -> NULL

Since there is a small gap between checking skb queue length and skb being unconditionally dequeued in zdmactxtodev(), skbdequeue() can return NULL. Then the pointer is passed to zdmactxstatus() where it is dereferenced.

In order to avoid potential NULL pointer dereference due to situations like above, check if skb is not NULL before passing it to zdmactx_status().

Found by Linux Verification Center (linuxtesting.org) with SVACE.