CVE-2025-38605

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()

In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to

retrieve the ab pointer. In vdev delete sequence the arvif->ar could

become NULL and that would trigger kernel panic.

Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it

directly to avoid panic and unnecessary dereferencing.

PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]"

LR points to "ath12k_dp_tx+0xc8/0x988 [ath12k]".

The Backtrace obtained is as follows:

ath12k_dp_tx+0x228/0x988 [ath12k]

ath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k]

ieee80211_process_measurement_req+0x320/0x348 [mac80211]

ieee80211_tx_dequeue+0x9ac/0x1518 [mac80211]

ieee80211_tx_dequeue+0xb14/0x1518 [mac80211]

ieee80211_tx_prepare_skb+0x224/0x254 [mac80211]

ieee80211_xmit+0xec/0x100 [mac80211]

__ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211]

ieee80211_subif_start_xmit+0x2e8/0x30

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References