---
id: CVE-2025-37794
title: 'wifi: mac80211: Purge vif txq in ieee80211_do_stop()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: Purge vif txq in ieee80211_do_stop()

  After ieee80211_do_stop() SKB from vif's txq could still be processed.
  Indeed another concurrent vif schedule_and_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 <
    929ec2c9ad34248ef625e137b6118b6e965797d9
  - >-
    Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 <
    a932a5ce4eee0cbad20220f950fe7bd3534bcbc9
  - >-
    Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 <
    305741e7e63234cbcf9b5c4e6aeca25ba0834be8
  - >-
    Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 <
    5f6863dc407f25fcf23fc857f9ac51756a09ea2c
  - >-
    Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 <
    c74b84544dee27298a71715b3ce2c40d372b5a23
  - >-
    Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 <
    a8df245b5b29f6de98d016dc18e2bb35ec70b0cb
  - >-
    Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 <
    8bc34db7f771a464ff8f686b6f8d4e04963fec27
  - >-
    Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 <
    378677eb8f44621ecc9ce659f7af61e5baa94d81
  - Linux 4.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:40:56.867124Z'
published: '2025-05-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:41:54.437Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-37794'
references:
  - url: 'https://git.kernel.org/stable/c/929ec2c9ad34248ef625e137b6118b6e965797d9'
  - url: 'https://git.kernel.org/stable/c/a932a5ce4eee0cbad20220f950fe7bd3534bcbc9'
  - url: 'https://git.kernel.org/stable/c/305741e7e63234cbcf9b5c4e6aeca25ba0834be8'
  - url: 'https://git.kernel.org/stable/c/5f6863dc407f25fcf23fc857f9ac51756a09ea2c'
  - url: 'https://git.kernel.org/stable/c/c74b84544dee27298a71715b3ce2c40d372b5a23'
  - url: 'https://git.kernel.org/stable/c/a8df245b5b29f6de98d016dc18e2bb35ec70b0cb'
  - url: 'https://git.kernel.org/stable/c/8bc34db7f771a464ff8f686b6f8d4e04963fec27'
  - url: 'https://git.kernel.org/stable/c/378677eb8f44621ecc9ce659f7af61e5baa94d81'
tags:
  - cve.org
epss: 0.00199
epssPercentile: 0.0981
ingestedAt: '2026-11-05T22:38:31.871Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Purge vif txq in ieee80211_do_stop()

After ieee80211_do_stop() SKB from vif's txq could still be processed.
Indeed another concurrent vif schedule_and_wake_txq call could cause
those packets to be dequeued (see ieee80211_handle_wake_tx_queue())
without checking the sdata current state.

Because vif.drv_priv is now cleared in this function, this could lead to
driver crash.

For example in ath12k, ahvif is store in vif.drv_priv. Thus if
ath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif->ah can be
NULL, leading the ath12k_warn(ahvif->ah,...) call in this function to
trigger the NULL deref below.

  Unable to handle kernel paging request at virtual address dfffffc000000001
  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
  batman_adv: bat0: Interface deactivated: brbh1337
  Mem abort info:
    ESR = 0x0000000096000004
    EC = 0x25: DABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
    FSC = 0x04: level 0 translation fault
  Data abort info:
    ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
    CM = 0, WnR = 0, TnD = 0, TagAccess = 0
    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
  [dfffffc000000001] address between user and kernel address ranges
  Internal error: Oops: 0000000096000004 [#1] SMP
  CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114
  Hardware name: HW (DT)
  pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
  pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k]
  lr : ath12k_mac_op_tx+0x174/0x29b8 [ath12k]
  sp : ffffffc086ace450
  x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4
  x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e
  x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0
  x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958
  x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8
  x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03
  x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40
  x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0
  x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001
  x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008
  Call trace:
   ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P)
   ieee80211_handle_wake_tx_queue+0x16c/0x260
   ieee80211_queue_skb+0xeec/0x1d20
   ieee80211_tx+0x200/0x2c8
   ieee80211_xmit+0x22c/0x338
   __ieee80211_subif_start_xmit+0x7e8/0xc60
   ieee80211_subif_start_xmit+0xc4/0xee0
   __ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0
   ieee80211_subif_start_xmit_8023+0x124/0x488
   dev_hard_start_xmit+0x160/0x5a8
   __dev_queue_xmit+0x6f8/0x3120
   br_dev_queue_push_xmit+0x120/0x4a8
   __br_forward+0xe4/0x2b0
   deliver_clone+0x5c/0xd0
   br_flood+0x398/0x580
   br_dev_xmit+0x454/0x9f8
   dev_hard_start_xmit+0x160/0x5a8
   __dev_queue_xmit+0x6f8/0x3120
   ip6_finish_output2+0xc28/0x1b60
   __ip6_finish_output+0x38c/0x638
   ip6_output+0x1b4/0x338
   ip6_local_out+0x7c/0xa8
   ip6_send_skb+0x7c/0x1b0
   ip6_push_pending_frames+0x94/0xd0
   rawv6_sendmsg+0x1a98/0x2898
   inet_sendmsg+0x94/0xe0
   __sys_sendto+0x1e4/0x308
   __arm64_sys_sendto+0xc4/0x140
   do_el0_svc+0x110/0x280
   el0_svc+0x20/0x60
   el0t_64_sync_handler+0x104/0x138
   el0t_64_sync+0x154/0x158

To avoid that, empty vif's txq at ieee80211_do_stop() so no packet could
be dequeued after ieee80211_do_stop() (new packets cannot be queued
because SDATA_STATE_RUNNING is cleared at this point).

## Affected

- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 929ec2c9ad34248ef625e137b6118b6e965797d9`
- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < a932a5ce4eee0cbad20220f950fe7bd3534bcbc9`
- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 305741e7e63234cbcf9b5c4e6aeca25ba0834be8`
- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 5f6863dc407f25fcf23fc857f9ac51756a09ea2c`
- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < c74b84544dee27298a71715b3ce2c40d372b5a23`
- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < a8df245b5b29f6de98d016dc18e2bb35ec70b0cb`
- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 8bc34db7f771a464ff8f686b6f8d4e04963fec27`
- `Linux >= ba8c3d6f16a1f9305c23ac1d2fd3992508c5ac03 < 378677eb8f44621ecc9ce659f7af61e5baa94d81`
- `Linux 4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.