CVE-2025-38606
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel, the ath12k Wi-Fi driver accesses an uninitialized arvif->ar pointer during beacon miss handling. This occurs for P2P interfaces that have their radio object detached after scan completion, leading to a NULL pointer dereference and kernel crash (KASAN: null-ptr-deref).
Risk Assessment
This can cause a kernel panic on systems with ath12k Wi-Fi cards, resulting in wireless network unavailability and potential system disruption.
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2025-38606 or apply the appropriate patch provided by your distribution.
Other vulnerabilities in Linux kernel ath12k driver
See all- CVE-2026-23130Medium
In the Linux kernel, the wifi ath12k driver has a deadlock while flushing management frames. After management transmission was converted to a wiphy work, ath12k_mac_op_flush() called with a NULL vif holds the wiphy lock, preventing the queued transmission work from running. This results in failed authentication/association and a 'failed to flush mgmt transmit queue' error.
- CVE-2025-37743Medium
In the Linux kernel, the wifi ath12k driver has a memory leak when enabling extended statistics mode. The driver allocates a mon_mpdu object while handling the HAL_RX_MPDU_START TLV but does not free it when only extended statistics mode is active (without standalone monitor mode).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the radio object (ar) via arvif->deflink->ar. However, after commit aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO"), arvif is linked to a radio only after vdev creation, typically when a channel is assigned or a scan is requested. For P2P capable devices, a default P2P interface is created by wpa_supplicant along with regular station interfaces, these serve as dummy interfaces for P2P-capable stations, lack an associated netdev and initiate frequent scans to discover neighbor p2p devices. When a scan is initiated on such P2P vifs, driver selects destination radio (ar) based on scan frequency, creates a scan vdev, and attaches arvif to the radio. Once the scan completes or is aborted, the scan vdev is deleted, detaching arvif from the radio and leaving arvif->ar uninitialized. While handling beacon miss for station interfaces, P2P interface is also encountered in the vif iteration and ath12k_mac_handle_beacon_miss_iter() tries to dereference the uninitialized arvif->deflink->ar. Fix this by verifying that vdev is created for the arvif before accessing its ar during beacon miss handling and similar vif iterator callbacks. ========================================================================== wlp6s0: detected beacon loss from AP (missed 7 beacons) - probing KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt-ath+ #2 PREEMPT(full) RIP: 0010:ath12k_mac_handle_beacon_miss_iter+0xb5/0x1a0 [ath12k] Call Trace: __iterate_interfaces+0x11a/0x410 [mac80211] ieee80211_iterate_active_interfaces_atomic+0x61/0x140 [mac80211] ath12k_mac_handle_beacon_miss+0xa1/0xf0 [ath12k] ath12k_roam_event+0x393/0x560 [ath12k] ath12k_wmi_op_rx+0x1486/0x28c0 [ath12k] ath12k_htc_process_trailer.isra.0+0x2fb/0x620 [ath12k] ath12k_htc_rx_completion_handler+0x448/0x830 [ath12k] ath12k_ce_recv_process_cb+0x549/0x9e0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] process_one_work+0xe3a/0x1430 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Vulnerability data from NVD (NIST) · CISA KEV · EPSS