CVE-2025-37794

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Purge vif txq in ieee80211_do_stop()

After ieee80211_do_stop() SKB from vif's txq could still be processed.

Indeed another concurrent vif schedule_and_wake_txq call could cause

those packets to be dequeued (see ieee80211_handle_wake_tx_queue())

without checking the sdata current state.

Because vif.drv_priv is now cleared in this function, this could lead to

driver crash.

For example in ath12k, ahvif is store in vif.drv_priv. Thus if

ath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif->ah can be

NULL, leading the ath12k_warn(ahvif->ah,...) call in this function to

trigger the NULL deref below.

Unable to handle kernel paging request at virtual address dfffffc000000001

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]

batman_adv: bat0: Interface deactivated: brbh1337

Mem abort info:

ESR = 0x0000000096000004

EC = 0x25: DABT (current EL), IL = 32 bits

S

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References