{"id":"CVE-2025-37794","title":"wifi: mac80211: Purge vif txq in ieee80211_do_stop()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Purge vif txq in ieee80211_do_stop()\n\nAfter ieee80211_do_stop() SKB from vif's txq could still be processed.\nIndeed another concurrent vif schedule_and_…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 929ec2c9ad34248ef625e137b6118b6e965797d9","Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < a932a5ce4eee0cbad20220f950fe7bd3534bcbc9","Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 305741e7e63234cbcf9b5c4e6aeca25ba0834be8","Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 5f6863dc407f25fcf23fc857f9ac51756a09ea2c","Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < c74b84544dee27298a71715b3ce2c40d372b5a23","Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < a8df245b5b29f6de98d016dc18e2bb35ec70b0cb","Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 8bc34db7f771a464ff8f686b6f8d4e04963fec27","Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 378677eb8f44621ecc9ce659f7af61e5baa94d81","Linux 4.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:40:56.867124Z"},"published":"2025-05-01","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:41:54.437Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-37794","references":[{"url":"https://git.kernel.org/stable/c/929ec2c9ad34248ef625e137b6118b6e965797d9"},{"url":"https://git.kernel.org/stable/c/a932a5ce4eee0cbad20220f950fe7bd3534bcbc9"},{"url":"https://git.kernel.org/stable/c/305741e7e63234cbcf9b5c4e6aeca25ba0834be8"},{"url":"https://git.kernel.org/stable/c/5f6863dc407f25fcf23fc857f9ac51756a09ea2c"},{"url":"https://git.kernel.org/stable/c/c74b84544dee27298a71715b3ce2c40d372b5a23"},{"url":"https://git.kernel.org/stable/c/a8df245b5b29f6de98d016dc18e2bb35ec70b0cb"},{"url":"https://git.kernel.org/stable/c/8bc34db7f771a464ff8f686b6f8d4e04963fec27"},{"url":"https://git.kernel.org/stable/c/378677eb8f44621ecc9ce659f7af61e5baa94d81"}],"tags":["cve.org"],"epss":0.00199,"epssPercentile":0.0981,"ingestedAt":"2026-11-05T22:38:31.871Z","slug":"CVE-2025-37794","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Purge vif txq in ieee80211_do_stop()\n\nAfter ieee80211_do_stop() SKB from vif's txq could still be processed.\nIndeed another concurrent vif schedule_and_wake_txq call could cause\nthose packets to be dequeued (see ieee80211_handle_wake_tx_queue())\nwithout checking the sdata current state.\n\nBecause vif.drv_priv is now cleared in this function, this could lead to\ndriver crash.\n\nFor example in ath12k, ahvif is store in vif.drv_priv. Thus if\nath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif->ah can be\nNULL, leading the ath12k_warn(ahvif->ah,...) call in this function to\ntrigger the NULL deref below.\n\n  Unable to handle kernel paging request at virtual address dfffffc000000001\n  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n  batman_adv: bat0: Interface deactivated: brbh1337\n  Mem abort info:\n    ESR = 0x0000000096000004\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x04: level 0 translation fault\n  Data abort info:\n    ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n    CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n  [dfffffc000000001] address between user and kernel address ranges\n  Internal error: Oops: 0000000096000004 [#1] SMP\n  CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114\n  Hardware name: HW (DT)\n  pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k]\n  lr : ath12k_mac_op_tx+0x174/0x29b8 [ath12k]\n  sp : ffffffc086ace450\n  x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4\n  x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e\n  x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0\n  x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958\n  x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8\n  x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03\n  x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40\n  x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0\n  x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001\n  x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008\n  Call trace:\n   ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P)\n   ieee80211_handle_wake_tx_queue+0x16c/0x260\n   ieee80211_queue_skb+0xeec/0x1d20\n   ieee80211_tx+0x200/0x2c8\n   ieee80211_xmit+0x22c/0x338\n   __ieee80211_subif_start_xmit+0x7e8/0xc60\n   ieee80211_subif_start_xmit+0xc4/0xee0\n   __ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0\n   ieee80211_subif_start_xmit_8023+0x124/0x488\n   dev_hard_start_xmit+0x160/0x5a8\n   __dev_queue_xmit+0x6f8/0x3120\n   br_dev_queue_push_xmit+0x120/0x4a8\n   __br_forward+0xe4/0x2b0\n   deliver_clone+0x5c/0xd0\n   br_flood+0x398/0x580\n   br_dev_xmit+0x454/0x9f8\n   dev_hard_start_xmit+0x160/0x5a8\n   __dev_queue_xmit+0x6f8/0x3120\n   ip6_finish_output2+0xc28/0x1b60\n   __ip6_finish_output+0x38c/0x638\n   ip6_output+0x1b4/0x338\n   ip6_local_out+0x7c/0xa8\n   ip6_send_skb+0x7c/0x1b0\n   ip6_push_pending_frames+0x94/0xd0\n   rawv6_sendmsg+0x1a98/0x2898\n   inet_sendmsg+0x94/0xe0\n   __sys_sendto+0x1e4/0x308\n   __arm64_sys_sendto+0xc4/0x140\n   do_el0_svc+0x110/0x280\n   el0_svc+0x20/0x60\n   el0t_64_sync_handler+0x104/0x138\n   el0t_64_sync+0x154/0x158\n\nTo avoid that, empty vif's txq at ieee80211_do_stop() so no packet could\nbe dequeued after ieee80211_do_stop() (new packets cannot be queued\nbecause SDATA_STATE_RUNNING is cleared at this point).\n\n## Affected\n\n- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 929ec2c9ad34248ef625e137b6118b6e965797d9`\n- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < a932a5ce4eee0cbad20220f950fe7bd3534bcbc9`\n- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 305741e7e63234cbcf9b5c4e6aeca25ba0834be8`\n- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 5f6863dc407f25fcf23fc857f9ac51756a09ea2c`\n- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < c74b84544dee27298a71715b3ce2c40d372b5a23`\n- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < a8df245b5b29f6de98d016dc18e2bb35ec70b0cb`\n- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 8bc34db7f771a464ff8f686b6f8d4e04963fec27`\n- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 378677eb8f44621ecc9ce659f7af61e5baa94d81`\n- `Linux 4.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}