Critical Node Corruption Vulnerability in Linux Package: ath12k WLAN Driver
Summary
DEBIAN-CVE-2025-38290: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix node corruption in ar->arvifs list In current WLAN recovery code flow, ath12k_core_halt() only reinitializes the "arvifs" list head. Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. The ath12k driver is specifically responsible for handling wireless networking interfaces. This driver is crucial for enabling wireless connectivity and ensuring stable communication between devices. However, vulnerabilities in this driver can lead to severe system instability and security risks, making it imperative to address any identified issues promptly.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ath12k WLAN driver, where improper handling of the 'arvifs' list during WLAN recovery can lead to node corruption. Specifically, the function ath12k_core_halt() only reinitializes the list head, leaving the subsequent node in an invalid state. This can trigger a kernel panic if a WLAN recovery occurs during the execution of a virtual interface (vif) removal, particularly before acquiring the necessary locks. The vulnerability can lead to system crashes and instability, impacting the overall functionality of the wireless network.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as it is available to avoid potential system crashes.
Conclusion
The identified vulnerability in the ath12k WLAN driver of the Linux package poses significant risks to system stability and security. It is crucial for users to update to the patched version to mitigate these risks. Regular monitoring and updates are essential for maintaining a secure system.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves node corruption in the 'arvifs' list, which can lead to kernel panics during WLAN recovery.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may result in system crashes and instability, particularly affecting wireless connectivity.
Yes, the issue is fixed in version 6.12.35-1 of the Linux package. Users should update to this version or later.
Regularly update your packages and monitor for vulnerabilities using tools like Vulert to ensure your system remains secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
