Invalid Memory Access in Linux Kernel's ath12k Module: CVE-2025-37944
Summary
DEBIAN-CVE-2025-37944: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry to fet... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and managing hardware resources. The 'linux' package in Debian is crucial for system functionality, enabling communication between software and hardware. This package is subject to various vulnerabilities, including CVE-2025-37944, which affects the ath12k module responsible for wireless communication.
Vulnerability Detail
In the Linux kernel, specifically within the ath12k module, a vulnerability has been identified where the function ath12k_dp_mon_srng_process incorrectly uses ath12k_hal_srng_src_get_next_entry to fetch entries from a destination ring. This misuse can lead to invalid memory accesses, resulting in potential data corruption or system crashes due to accessing incorrect memory locations. The issue arises from the different handling mechanisms for source and destination rings, leading to incorrect pointer arithmetic and ring management.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the package as mentioned above.
Conclusion
CVE-2025-37944 is a critical vulnerability in the Linux kernel's ath12k module that can lead to severe system issues. It is essential to update the 'linux' package to the patched version 6.12.25-1 to ensure system integrity and prevent potential exploits.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37944 is a vulnerability in the Linux kernel's ath12k module that can lead to invalid memory accesses and potential system crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against CVE-2025-37944 using the Vulert playground at Vulert Scanner.
Exploiting this vulnerability can lead to data corruption or crashes due to accessing incorrect memory locations, affecting system stability.
Yes, a patch is available in version 6.12.25-1 of the linux package. Updating to this version will fix the vulnerability.
While there are no specific workarounds, it is recommended to prioritize updating the package to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
