CVE-2025-23133

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: update channel list in reg notifier instead reg worker

Currently when ath11k gets a new channel list, it will be processed

according to the following steps:

1. update new channel list to cfg80211 and queue reg_work.

2. cfg80211 handles new channel list during reg_work.

3. update cfg80211's handled channel list to firmware by

ath11k_reg_update_chan_list().

But ath11k will immediately execute step 3 after reg_work is just

queued. Since step 2 is asynchronous, cfg80211 may not have completed

handling the new channel list, which may leading to an out-of-bounds

write error:

BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list

Call Trace:

ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]

kfree+0x109/0x3a0

ath11k_regd_update+0x1cf/0x350 [ath11k]

ath11k_regd_update_work+0x14/0x20 [ath11k]

process_one_work+0xe35/0x14c0

Should ensure step 2 is completely done before executing step 3.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References