CVE-2025-37943

A flaw was discovered in the Linux kernel's driver for Qualcomm Atheros Wi-fi 7 driver (ath12k). An attacker with the ability to generate real or simulated network traffic could exploit this vulnerability to modify kernel memory, leading to a denial of service, compromised system integrity, or an elevation of privileges.

This vulnerability in the ath12k driver can be exploited when hardware which uses that driver provides malformed packets, specifically packets with a header length longer than permitted by the Wi-Fi specification. An attacker who can generate packets to be processed by this driver could exploit this flaw to alter kernel memory, resulting in the ability to escalate their privileges or otherwise compromise system integrity and stability.

These drivers are not included in Red Hat Enterprise Linux prior to 9.6, so those systems are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ath12k module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Note that this will make hardware that uses that chipset unavailable, so this mitigation is not suitable for systems that rely on Qualcomm Wi-Fi 7 network adapters.