---
id: CVE-2025-39732
title: 'wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()

  ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to
  ieee80211_iterate_stations_a…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    1f45a710c82b29d4c501b1cb472dff68d59ecc8c
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    9c0e3144924c7db701575a73af341d33184afeaf
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    7d4d0db0dc9424de2bdc0b45e919e4892603356f
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    6bdef22d540258ca06f079f7b6ae100669a19b47
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    65c12b104cb942d588a1a093acc4537fb3d3b129
  - Linux 5.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:53:50.418566Z'
published: '2025-09-07'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:37:18.108Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39732'
references:
  - url: 'https://git.kernel.org/stable/c/1f45a710c82b29d4c501b1cb472dff68d59ecc8c'
  - url: 'https://git.kernel.org/stable/c/9c0e3144924c7db701575a73af341d33184afeaf'
  - url: 'https://git.kernel.org/stable/c/7d4d0db0dc9424de2bdc0b45e919e4892603356f'
  - url: 'https://git.kernel.org/stable/c/6bdef22d540258ca06f079f7b6ae100669a19b47'
  - url: 'https://git.kernel.org/stable/c/65c12b104cb942d588a1a093acc4537fb3d3b129'
tags:
  - cve.org
epss: 0.00199
epssPercentile: 0.09682
ingestedAt: '2026-10-15T22:48:25.522Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()

ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to
ieee80211_iterate_stations_atomic(). Note in this case the iterator is
required to be atomic, however ath11k_mac_disable_peer_fixed_rate() does
not follow it as it might sleep. Consequently below warning is seen:

BUG: sleeping function called from invalid context at wmi.c:304
Call Trace:
 <TASK>
 dump_stack_lvl
 __might_resched.cold
 ath11k_wmi_cmd_send
 ath11k_wmi_set_peer_param
 ath11k_mac_disable_peer_fixed_rate
 ieee80211_iterate_stations_atomic
 ath11k_mac_op_set_bitrate_mask.cold

Change to ieee80211_iterate_stations_mtx() to fix this issue.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30

## Affected

- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 1f45a710c82b29d4c501b1cb472dff68d59ecc8c`
- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 9c0e3144924c7db701575a73af341d33184afeaf`
- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 7d4d0db0dc9424de2bdc0b45e919e4892603356f`
- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 6bdef22d540258ca06f079f7b6ae100669a19b47`
- `Linux >= d5c65159f2895379e11ca13f62feabe93278985d < 65c12b104cb942d588a1a093acc4537fb3d3b129`
- `Linux 5.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.