Out-of-Bounds Write Vulnerability in Linux Kernel's ath11k Package
Summary
CVE-2025-23133: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: update channel list in reg notifier instead reg worker Currently when ath11k gets a new channel list, it will be processed according to th... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing hardware resources and providing essential services for software applications. The ath11k driver is responsible for supporting Qualcomm's Wi-Fi 6 chipsets, enabling wireless communication. This driver is crucial for maintaining stable and efficient network connections. However, a vulnerability has been identified in the ath11k driver that can lead to severe security issues if not addressed.
Vulnerability Detail
In the Linux kernel, specifically within the ath11k driver, a vulnerability exists where an out-of-bounds write error can occur. This issue arises when the driver processes a new channel list. The steps involved in this process are asynchronous, meaning that the driver may attempt to update the firmware with a new channel list before the previous update has been fully handled by cfg80211. This can lead to memory corruption and potential system crashes, as indicated by the KASAN (Kernel Address Sanitizer) error logs. The vulnerability is particularly critical as it can be exploited to execute arbitrary code or cause denial of service.
How To Fix
No fixed version is published for this vulnerability.
To rectify this vulnerability, it is essential to update the Linux kernel to a patched version that addresses this issue. Users should check for updates in their package manager and install the latest version of the Linux kernel. For Debian-based systems, the command to update the package is as follows:
sudo apt-get update && sudo apt-get upgrade linux
Ensure that the updated version includes the patch for CVE-2025-23133.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the vulnerability by disabling the ath11k driver until a patch is applied. This can be done by executing the following command: sudo modprobe -r ath11k. However, this will disable Wi-Fi functionality, so it should only be used if necessary.
Conclusion
The CVE-2025-23133 vulnerability in the Linux kernel's ath11k driver poses a significant risk due to its potential for causing out-of-bounds write errors. Users are urged to update their systems promptly to mitigate this risk. Temporary workarounds are available, but they may affect system functionality. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-23133 is a vulnerability in the Linux kernel's ath11k driver that can lead to an out-of-bounds write error, potentially causing system crashes or arbitrary code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, consider disabling the ath11k driver as a temporary workaround to mitigate the risk of exploitation.
Detailed information about CVE-2025-23133 can be found in the official Linux kernel patch notes and security advisories.
Yes, users should look for the latest version of the Linux kernel that includes the patch for CVE-2025-23133. Always refer to your distribution's update logs for specific version details.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.