Critical Vulnerability in Linux Package: Sleeping Function Called from Invalid Context
Summary
CVE-2025-39732: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to ieee80211_ite... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process scheduling, and system security. It is widely used across various distributions, including Debian. The kernel's functionality is critical for system stability and performance. However, it is susceptible to vulnerabilities that can compromise system integrity and performance, such as the one identified in CVE-2025-39732.
Vulnerability Detail
In the Linux kernel, specifically within the ath11k module, a vulnerability has been identified where the function ath11k_mac_disable_peer_fixed_rate() is incorrectly used as an iterator in ieee80211_iterate_stations_atomic(). This function is not atomic and can lead to sleeping in an invalid context, resulting in system instability and potential crashes. The warning 'BUG: sleeping function called from invalid context' indicates that the function may cause unexpected behavior during operation, particularly in high-load scenarios.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workaround is provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate risks associated with this issue.
Conclusion
The CVE-2025-39732 vulnerability in the Linux kernel's ath11k module poses significant risks to system stability and performance. Users are advised to update their systems to the patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39732 is a vulnerability in the Linux kernel's ath11k module that allows a sleeping function to be called from an invalid context, potentially leading to system crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
The vulnerability can lead to system instability, crashes, and unexpected behavior during operation, especially under high load.
Yes, patches are available for Debian 13 (version 6.12.43-1) and Debian 14 (version 6.16.3-1). It is recommended to update to these versions.
While no specific workaround is provided, it is crucial to monitor the system for unusual behavior and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
