CVE-2025-38293

A flaw was found in the Linux kernel's ath11k Wi-Fi (WLAN) driver. During a WLAN recovery process, specifically when a virtual interface (vif) is being removed, a list node can become corrupted. This corruption can lead to a kernel panic, effectively causing a Denial of Service (DoS) for the system. A local attacker could potentially exploit this to crash the system.

A flaw was found in the Linux kernel's ath11k Wi-Fi (WLAN) driver, which ships in the kernel and kernel-rt packages of Red Hat Enterprise Linux 8, 9, and 10. In the WLAN recovery code flow, ath11k_core_halt() reinitializes only the head of the "arvifs" list, which can leave the list node immediately following the head in an invalid state. If a WLAN recovery occurs while a virtual interface (vif) is being removed, list_del() in ath11k_mac_op_remove_interface() detects this list corruption and triggers a kernel panic. A local attacker who can time a WLAN recovery with virtual interface removal, for example while bringing a wireless interface down, could crash the system, resulting in a denial of service; there is no impact to confidentiality or integrity. The vulnerable ath11k driver code is not present in RHEL 6, RHEL 7, or Red Hat In-Vehicle OS 1, so those products are not affected. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and low privileges and results only in loss of availability; this differs from the CVE.org score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which assumes an adjacent-network attack vector and confidentiality and integrity impact that the code analysis does not support. Fixes for the affected RHEL kernel and kernel-rt streams are currently deferred given the moderate severity, the local access and timing requirements, and the availability-only impact; the residual risk is limited to a local denial of service on systems using affected Qualcomm ath11k Wi-Fi hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.