In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Purge vif txq in ieee80211dostop()
After ieee80211dostop() SKB from vif's txq could still be processed. Indeed another concurrent vif scheduleandwaketxq call could cause those packets to be dequeued (see ieee80211handlewaketx_queue()) without checking the sdata current state.
Because vif.drv_priv is now cleared in this function, this could lead to driver crash.
For example in ath12k, ahvif is store in vif.drvpriv. Thus if ath12kmacoptx() is called after ieee80211dostop(), ahvif->ah can be NULL, leading the ath12k_warn(ahvif->ah,...) call in this function to trigger the NULL deref below.
Unable to handle kernel paging request at virtual address dfffffc000000001 KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] batmanadv: bat0: Interface deactivated: brbh1337 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfffffc000000001] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] SMP CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114 Hardware name: HW (DT) pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ath12kmacoptx+0x6cc/0x29b8 [ath12k] lr : ath12kmacoptx+0x174/0x29b8 [ath12k] sp : ffffffc086ace450 x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4 x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0 x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958 x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8 x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03 x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40 x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0 x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008 Call trace: ath12kmacoptx+0x6cc/0x29b8 [ath12k] (P) ieee80211handlewaketxqueue+0x16c/0x260 ieee80211queueskb+0xeec/0x1d20 ieee80211tx+0x200/0x2c8 ieee80211xmit+0x22c/0x338 _ieee80211subifstartxmit+0x7e8/0xc60 ieee80211subifstartxmit+0xc4/0xee0 _ieee80211subifstartxmit8023.isra.0+0x854/0x17a0 ieee80211subifstartxmit8023+0x124/0x488 devhardstartxmit+0x160/0x5a8 _devqueuexmit+0x6f8/0x3120 brdevqueuepushxmit+0x120/0x4a8 _brforward+0xe4/0x2b0 deliverclone+0x5c/0xd0 brflood+0x398/0x580 brdevxmit+0x454/0x9f8 devhardstartxmit+0x160/0x5a8 _devqueuexmit+0x6f8/0x3120 ip6finishoutput2+0xc28/0x1b60 _ip6finishoutput+0x38c/0x638 ip6output+0x1b4/0x338 ip6localout+0x7c/0xa8 ip6sendskb+0x7c/0x1b0 ip6pushpendingframes+0x94/0xd0 rawv6sendmsg+0x1a98/0x2898 inetsendmsg+0x94/0xe0 _syssendto+0x1e4/0x308 _arm64syssendto+0xc4/0x140 doel0svc+0x110/0x280 el0svc+0x20/0x60 el0t64synchandler+0x104/0x138 el0t64sync+0x154/0x158
To avoid that, empty vif's txq at ieee80211dostop() so no packet could be dequeued after ieee80211dostop() (new packets cannot be queued because SDATASTATERUNNING is cleared at this point).
[
{
"id": "CVE-2025-37794-01c5c3b3",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"line_hashes": [
"22939782199480173190220091135593096196",
"170564972678789658819434980755446002293",
"13286488072606140085404042785821219779"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f6863dc407f25fcf23fc857f9ac51756a09ea2c"
},
{
"id": "CVE-2025-37794-02dea3c2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "203141021690343082958043423751734622769",
"length": 5356.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8df245b5b29f6de98d016dc18e2bb35ec70b0cb"
},
{
"id": "CVE-2025-37794-058f62b2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"line_hashes": [
"22939782199480173190220091135593096196",
"170564972678789658819434980755446002293",
"13286488072606140085404042785821219779"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c74b84544dee27298a71715b3ce2c40d372b5a23"
},
{
"id": "CVE-2025-37794-0856a150",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"line_hashes": [
"22939782199480173190220091135593096196",
"170564972678789658819434980755446002293",
"13286488072606140085404042785821219779"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@378677eb8f44621ecc9ce659f7af61e5baa94d81"
},
{
"id": "CVE-2025-37794-1d0b186a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"line_hashes": [
"22939782199480173190220091135593096196",
"170564972678789658819434980755446002293",
"13286488072606140085404042785821219779"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@929ec2c9ad34248ef625e137b6118b6e965797d9"
},
{
"id": "CVE-2025-37794-2542b34e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "104067484427414984679262398388472419517",
"length": 5444.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a932a5ce4eee0cbad20220f950fe7bd3534bcbc9"
},
{
"id": "CVE-2025-37794-2d95d287",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"line_hashes": [
"22939782199480173190220091135593096196",
"170564972678789658819434980755446002293",
"13286488072606140085404042785821219779"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bc34db7f771a464ff8f686b6f8d4e04963fec27"
},
{
"id": "CVE-2025-37794-2e619d16",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "65390097409166414021900566973997785099",
"length": 5291.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@305741e7e63234cbcf9b5c4e6aeca25ba0834be8"
},
{
"id": "CVE-2025-37794-4c42a4b8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "182674965096136645910781810785328297383",
"length": 5441.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8bc34db7f771a464ff8f686b6f8d4e04963fec27"
},
{
"id": "CVE-2025-37794-951949c7",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"line_hashes": [
"22939782199480173190220091135593096196",
"170564972678789658819434980755446002293",
"13286488072606140085404042785821219779"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a932a5ce4eee0cbad20220f950fe7bd3534bcbc9"
},
{
"id": "CVE-2025-37794-98dc9941",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"line_hashes": [
"22939782199480173190220091135593096196",
"170564972678789658819434980755446002293",
"13286488072606140085404042785821219779"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8df245b5b29f6de98d016dc18e2bb35ec70b0cb"
},
{
"id": "CVE-2025-37794-9e0a88c7",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "61754348534287368768171412493328242104",
"length": 5435.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@378677eb8f44621ecc9ce659f7af61e5baa94d81"
},
{
"id": "CVE-2025-37794-ce976f0f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "92144288875510381660268506195035281591",
"length": 5502.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@929ec2c9ad34248ef625e137b6118b6e965797d9"
},
{
"id": "CVE-2025-37794-d53082d2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "248246425414202153482779400339217368233",
"length": 5525.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c74b84544dee27298a71715b3ce2c40d372b5a23"
},
{
"id": "CVE-2025-37794-e9470ead",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "net/mac80211/iface.c",
"function": "ieee80211_do_stop"
},
"digest": {
"function_hash": "121128980286934146215357971729967144572",
"length": 5576.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f6863dc407f25fcf23fc857f9ac51756a09ea2c"
},
{
"id": "CVE-2025-37794-fe673529",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "net/mac80211/iface.c"
},
"digest": {
"line_hashes": [
"22939782199480173190220091135593096196",
"170564972678789658819434980755446002293",
"13286488072606140085404042785821219779"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@305741e7e63234cbcf9b5c4e6aeca25ba0834be8"
}
]