CVE-2025-37943: Linux Kernel ath12k Buffer Overflow Vulnerability

CVE-2025-37943 Overview

CVE-2025-37943 is an out-of-bounds write vulnerability [CWE-787] in the Linux kernel's ath12k Wi-Fi driver. The flaw exists in the ath12k_dp_rx_h_undecap_nwifi function, which handles receive-side decapsulation for native Wi-Fi frames. When hardware delivers packets exceeding the maximum native Wi-Fi header length, the function accesses and modifies header fields beyond expected bounds. This can lead to invalid memory access and memory corruption within kernel space. The issue was confirmed on QCN9274 hardware running WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 firmware.

Critical Impact
Memory corruption in the Linux kernel Wi-Fi receive path may lead to kernel panic, denial of service, or potential local privilege escalation on systems using the ath12k driver.

Affected Products

Linux kernel branches including the ath12k driver prior to the fixed commits
Systems using Qualcomm QCN9274 hw2.0 PCI WLAN adapters
Distributions shipping Wi-Fi 7 (ath12k) support without the upstream fix

Discovery Timeline

2025-05-20 - CVE-2025-37943 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-37943

Vulnerability Analysis

The vulnerability resides in the receive data path of the ath12k driver used for Qualcomm Wi-Fi 7 devices. During packet processing, the driver invokes ath12k_dp_rx_h_undecap_nwifi to strip and rewrite native Wi-Fi headers on incoming socket buffers (SKBs). The function assumes that the packet length delivered by hardware never exceeds the maximum size of the native Wi-Fi header structure.

When the hardware, due to malformed frames or unexpected conditions, provides a packet whose length exceeds this bound, the driver still writes into fields of the header structure. Writing beyond the intended buffer boundary corrupts adjacent kernel memory. Because this occurs inside the network receive path, the corruption is triggered by frame reception rather than by user interaction.

Root Cause

The root cause is missing input validation on the SKB length before the driver dereferences and modifies native Wi-Fi header fields. Without a sanity check comparing the packet length against the expected native Wi-Fi header size, the code path performs unchecked pointer writes. The upstream patch introduces a length check before processing the SKB in the DP_RX_DECAP_TYPE_NATIVE_WIFI decap branch, aborting processing when the length is invalid.

Attack Vector

Exploitation requires local access with low privileges, matching the local attack vector classification. The vulnerability is triggered through the wireless receive pipeline, so an attacker capable of injecting or influencing crafted native Wi-Fi frames processed by an ath12k interface can drive the vulnerable code path. Successful triggering results in kernel memory corruption, which can be leveraged for denial of service or, depending on memory layout, further exploitation impacting confidentiality, integrity, and availability.

No public proof-of-concept exploit is currently available, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-37943

Indicators of Compromise

Kernel oops or panic traces referencing ath12k_dp_rx_h_undecap_nwifi or nearby symbols in the ath12k receive path
Unexpected ath12k driver crashes or interface resets on hosts using QCN9274 or related Wi-Fi 7 hardware
SLUB or KASAN reports flagging out-of-bounds writes originating from the ath12k module

Detection Strategies

Inventory Linux hosts running kernel versions predating the fix commits (3abe15e, 50be1fb, 6ee6531, 7f1d986, 9a0dddf) with ath12k loaded
Enable kernel hardening features such as KASAN in test environments to catch out-of-bounds writes in the Wi-Fi receive path
Correlate wireless interface flapping with kernel log entries pointing to ath12k decapsulation functions

Monitoring Recommendations

Forward dmesg and journald kernel messages to a centralized log store and alert on ath12k stack traces
Track loaded kernel module versions across the fleet and flag unpatched builds that expose ath12k
Monitor Wi-Fi driver stability metrics (interface resets, firmware reloads) as a proxy for exploitation attempts

How to Mitigate CVE-2025-37943

Immediate Actions Required

Apply the upstream stable kernel updates that include the fix commits referenced by kernel.org
Prioritize patching endpoints and access points that use QCN9274 or other ath12k-supported Wi-Fi 7 hardware
Restrict local access on affected systems while patches are being rolled out

Patch Information

The fix adds a sanity check on the SKB length before the driver processes the native Wi-Fi header in ath12k_dp_rx_h_undecap_nwifi. Merged commits are available at Kernel Git Commit 3abe15e, Kernel Git Commit 50be1fb, Kernel Git Commit 6ee6531, Kernel Git Commit 7f1d986, and Kernel Git Commit 9a0dddf. Rebuild and deploy kernels from your distribution vendor that incorporate these commits.

Workarounds

Unload the ath12k module (modprobe -r ath12k) on systems that do not require Wi-Fi 7 functionality
Disable or physically remove affected Qualcomm Wi-Fi adapters until a patched kernel is deployed
Limit exposure to untrusted wireless environments where crafted frames could be injected

bash

# Verify running kernel and ath12k module status
uname -r
lsmod | grep ath12k

# Temporarily unload the driver as a mitigation
sudo modprobe -r ath12k

# Prevent automatic loading until patched kernel is installed
echo "blacklist ath12k" | sudo tee /etc/modprobe.d/blacklist-ath12k.conf