CVE-2025-38116

A flaw was found in the Linux kernel's ath12k wireless driver. When device initialization fails, the driver does not properly unregister an internal notification handler before its memory is freed during module unloading. A local privileged user could exploit this use-after-free vulnerability upon subsequent access to the handler, leading to a Denial of Service (DoS) through a system crash.

The vulnerability is classified as a use-after-free in the ath12k_core_init() function. It occurs when the notifier chain is not properly unregistered upon initialization failure, potentially leading to kernel crashes upon later access. For the CVSS the Privileges Required (PR) metric is set to High, as exploitation requires the ability to load and unload kernel modules (e.g., insmod/rmmod), which is restricted to privileged users with CAP_SYS_MODULE or root access. The bug is relevant only for the latest version of Red Hat Enterprise Linux 9 (and newer), because in earlier versions the Linux kernel config option CONFIG_ATH12K was disabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module ath12k from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.