In the Linux kernel, the following vulnerability has been resolved:
wifi: zd1211rw: Fix potential NULL pointer dereference in zdmactxtodev()
There is a potential NULL pointer dereference in zdmactxtodev(). For example, the following is possible:
T0 T1
zdmactxtodev() /* len == skbqueuelen(q) */ while (len > ZDMACMAXACKWAITERS) {
filter_ack()
spin_lock_irqsave(&q->lock, flags);
/* position == skb_queue_len(q) */
for (i=1; i<position; i++)
skb = __skb_dequeue(q)
if (mac->type == NL80211_IFTYPE_AP)
skb = __skb_dequeue(q);
spin_unlock_irqrestore(&q->lock, flags);
skb_dequeue() -> NULL
Since there is a small gap between checking skb queue length and skb being unconditionally dequeued in zdmactxtodev(), skbdequeue() can return NULL. Then the pointer is passed to zdmactxstatus() where it is dereferenced.
In order to avoid potential NULL pointer dereference due to situations like above, check if skb is not NULL before passing it to zdmactx_status().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[
{
"signature_version": "v1",
"id": "CVE-2025-38513-0a8d7146",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57635166731985876792408396911823519176",
"289915465461922362782489203596439761458",
"19181573168404193311337241501835797069",
"255264399746601956710521658520558271761"
]
},
"target": {
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1958270de947604cc6de05fc96dbba256b49cf0",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-0d6deca8",
"deprecated": false,
"digest": {
"function_hash": "212598635162051599014719868423616913335",
"length": 573.0
},
"target": {
"function": "zd_mac_tx_to_dev",
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b24f65c184540dfb967479320ecf7e8c2e9220dc",
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-0eaf57a9",
"deprecated": false,
"digest": {
"function_hash": "212598635162051599014719868423616913335",
"length": 573.0
},
"target": {
"function": "zd_mac_tx_to_dev",
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@014c34dc132015c4f918ada4982e952947ac1047",
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-1ce92ec6",
"deprecated": false,
"digest": {
"function_hash": "212598635162051599014719868423616913335",
"length": 573.0
},
"target": {
"function": "zd_mac_tx_to_dev",
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1958270de947604cc6de05fc96dbba256b49cf0",
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-2c074416",
"deprecated": false,
"digest": {
"function_hash": "212598635162051599014719868423616913335",
"length": 573.0
},
"target": {
"function": "zd_mac_tx_to_dev",
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74b1ec9f5d627d2bdd5e5b6f3f81c23317657023",
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-2eb97deb",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57635166731985876792408396911823519176",
"289915465461922362782489203596439761458",
"19181573168404193311337241501835797069",
"255264399746601956710521658520558271761"
]
},
"target": {
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5420de65efbeb6503bcf1d43451c9df67ad60298",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-4b6051bc",
"deprecated": false,
"digest": {
"function_hash": "212598635162051599014719868423616913335",
"length": 573.0
},
"target": {
"function": "zd_mac_tx_to_dev",
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fcd9c923b58e86501450b9b442ccc7ce4a8d0fda",
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-54212860",
"deprecated": false,
"digest": {
"function_hash": "212598635162051599014719868423616913335",
"length": 573.0
},
"target": {
"function": "zd_mac_tx_to_dev",
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5420de65efbeb6503bcf1d43451c9df67ad60298",
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-54f8a9e9",
"deprecated": false,
"digest": {
"function_hash": "212598635162051599014719868423616913335",
"length": 573.0
},
"target": {
"function": "zd_mac_tx_to_dev",
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adf08c96b963c7cd7ec1ee1c0c556228d9bedaae",
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-84875048",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57635166731985876792408396911823519176",
"289915465461922362782489203596439761458",
"19181573168404193311337241501835797069",
"255264399746601956710521658520558271761"
]
},
"target": {
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b24f65c184540dfb967479320ecf7e8c2e9220dc",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-9b2a5a8e",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57635166731985876792408396911823519176",
"289915465461922362782489203596439761458",
"19181573168404193311337241501835797069",
"255264399746601956710521658520558271761"
]
},
"target": {
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fcd9c923b58e86501450b9b442ccc7ce4a8d0fda",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-c2bf253c",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57635166731985876792408396911823519176",
"289915465461922362782489203596439761458",
"19181573168404193311337241501835797069",
"255264399746601956710521658520558271761"
]
},
"target": {
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74b1ec9f5d627d2bdd5e5b6f3f81c23317657023",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-e6cba1ce",
"deprecated": false,
"digest": {
"function_hash": "212598635162051599014719868423616913335",
"length": 573.0
},
"target": {
"function": "zd_mac_tx_to_dev",
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@602b4eb2f25668de15de69860ec99caf65b3684d",
"signature_type": "Function"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-ece8765b",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57635166731985876792408396911823519176",
"289915465461922362782489203596439761458",
"19181573168404193311337241501835797069",
"255264399746601956710521658520558271761"
]
},
"target": {
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@014c34dc132015c4f918ada4982e952947ac1047",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-f1dbbf14",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57635166731985876792408396911823519176",
"289915465461922362782489203596439761458",
"19181573168404193311337241501835797069",
"255264399746601956710521658520558271761"
]
},
"target": {
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@602b4eb2f25668de15de69860ec99caf65b3684d",
"signature_type": "Line"
},
{
"signature_version": "v1",
"id": "CVE-2025-38513-f42a2e39",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57635166731985876792408396911823519176",
"289915465461922362782489203596439761458",
"19181573168404193311337241501835797069",
"255264399746601956710521658520558271761"
]
},
"target": {
"file": "drivers/net/wireless/zydas/zd1211rw/zd_mac.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adf08c96b963c7cd7ec1ee1c0c556228d9bedaae",
"signature_type": "Line"
}
]