In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash
Currently, we encounter the following kernel call trace when a firmware crash occurs. This happens because the host sends WMI commands to the firmware while it is in recovery, causing the commands to fail and resulting in the kernel call trace.
Set the ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags when the host driver receives the firmware crash notification from MHI. This prevents sending WMI commands to the firmware during recovery.
Call Trace: <TASK> dump_stack_lvl+0x75/0xc0 register_lock_class+0x6be/0x7a0 ? __lock_acquire+0x644/0x19a0 __lock_acquire+0x95/0x19a0 lock_acquire+0x265/0x310 ? ath12k_ce_send+0xa2/0x210 [ath12k] ? find_held_lock+0x34/0xa0 ? ath12k_ce_send+0x56/0x210 [ath12k] _raw_spin_lock_bh+0x33/0x70 ? ath12k_ce_send+0xa2/0x210 [ath12k] ath12k_ce_send+0xa2/0x210 [ath12k] ath12k_htc_send+0x178/0x390 [ath12k] ath12k_wmi_cmd_send_nowait+0x76/0xa0 [ath12k] ath12k_wmi_cmd_send+0x62/0x190 [ath12k] ath12k_wmi_pdev_bss_chan_info_request+0x62/0xc0 [ath1 ath12k_mac_op_get_survey+0x2be/0x310 [ath12k] ieee80211_dump_survey+0x99/0x240 [mac80211] nl80211_dump_survey+0xe7/0x470 [cfg80211] ? kmalloc_reserve+0x59/0xf0 genl_dumpit+0x24/0x70 netlink_dump+0x177/0x360 __netlink_dump_start+0x206/0x280 genl_family_rcv_msg_dumpit.isra.22+0x8a/0xe0 ? genl_family_rcv_msg_attrs_parse.isra.23+0xe0/0xe0 ? genl_op_lock.part.12+0x10/0x10 ? genl_dumpit+0x70/0x70 genl_rcv_msg+0x1d0/0x290 ? nl80211_del_station+0x330/0x330 [cfg80211] ? genl_get_cmd_both+0x50/0x50 netlink_rcv_skb+0x4f/0x100 genl_rcv+0x1f/0x30 netlink_unicast+0x1b6/0x260 netlink_sendmsg+0x31a/0x450 __sock_sendmsg+0xa8/0xb0 ____sys_sendmsg+0x1e4/0x260 ___sys_sendmsg+0x89/0xe0 ? local_clock_noinstr+0xb/0xc0 ? rcu_is_watching+0xd/0x40 ? kfree+0x1de/0x370 ? __sys_sendmsg+0x7a/0xc0
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 14, 2025 | Jul 10, 2025 |
| Suse | — | Upgrade dtb-socionextUpgrade kernel-develUpgrade dtb-lgUpgrade kernel-zfcpdumpUpgrade kernel-docs-htmlUpgrade kernel-macrosUpgrade reiserfs-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-default-livepatchUpgrade kernel-default-develUpgrade dtb-xilinxUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-64kbUpgrade kernel-default-optionalUpgrade dtb-marvellUpgrade kernel-obs-qaUpgrade kernel-64kb-develUpgrade dtb-alteraUpgrade kernel-symsUpgrade dtb-amdUpgrade dlm-kmp-defaultUpgrade dtb-allwinnerUpgrade dtb-freescaleUpgrade dtb-amazonUpgrade dtb-hisiliconUpgrade kernel-default-livepatch-develUpgrade dtb-broadcomUpgrade dtb-apmUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade kernel-rt-optionalUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade kernel-default-vdsoUpgrade dtb-nvidiaUpgrade cluster-md-kmp-rtUpgrade kernel-rtUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade dtb-rockchipUpgrade kernel-sourceUpgrade kselftests-kmp-defaultUpgrade kernel-default-baseUpgrade dtb-renesasUpgrade kernel-rt-develUpgrade kernel-docsUpgrade kernel-azure-develUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-64kbUpgrade dtb-qcomUpgrade kernel-source-vanillaUpgrade dtb-caviumUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-extraUpgrade dtb-armUpgrade dtb-amlogicUpgrade gfs2-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-rt-livepatchUpgrade kernel-devel-azureUpgrade dtb-sprdUpgrade kernel-rt-vdsoUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-default | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-oem-6.14Upgrade linux-image-6.14.0-1012-oemUpgrade linux-image-generic-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-oem-24.04Upgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-genericUpgrade linux-image-oem-24.04bUpgrade linux-image-oracleUpgrade linux-image-6.14.0-32-genericUpgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-azure-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-virtualUpgrade linux-image-raspi-6.14Upgrade linux-image-oem-24.04aUpgrade linux-image-azureUpgrade linux-image-realtimeUpgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-aws-64k-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-realtime-6.14Upgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-aws-6.14Upgrade linux-image-gcp-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-6.14.0-1013-awsUpgrade linux-image-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-awsUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-virtual-6.14 | Jul 14, 2025 | Jul 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub