In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash
Currently, we encounter the following kernel call trace when a firmware crash occurs. This happens because the host sends WMI commands to the firmware while it is in recovery, causing the commands to fail and resulting in the kernel call trace.
Set the ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags when the host driver receives the firmware crash notification from MHI. This prevents sending WMI commands to the firmware during recovery.
Call Trace: <TASK> dump_stack_lvl+0x75/0xc0 register_lock_class+0x6be/0x7a0 ? __lock_acquire+0x644/0x19a0 __lock_acquire+0x95/0x19a0 lock_acquire+0x265/0x310 ? ath12k_ce_send+0xa2/0x210 [ath12k] ? find_held_lock+0x34/0xa0 ? ath12k_ce_send+0x56/0x210 [ath12k] _raw_spin_lock_bh+0x33/0x70 ? ath12k_ce_send+0xa2/0x210 [ath12k] ath12k_ce_send+0xa2/0x210 [ath12k] ath12k_htc_send+0x178/0x390 [ath12k] ath12k_wmi_cmd_send_nowait+0x76/0xa0 [ath12k] ath12k_wmi_cmd_send+0x62/0x190 [ath12k] ath12k_wmi_pdev_bss_chan_info_request+0x62/0xc0 [ath1 ath12k_mac_op_get_survey+0x2be/0x310 [ath12k] ieee80211_dump_survey+0x99/0x240 [mac80211] nl80211_dump_survey+0xe7/0x470 [cfg80211] ? kmalloc_reserve+0x59/0xf0 genl_dumpit+0x24/0x70 netlink_dump+0x177/0x360 __netlink_dump_start+0x206/0x280 genl_family_rcv_msg_dumpit.isra.22+0x8a/0xe0 ? genl_family_rcv_msg_attrs_parse.isra.23+0xe0/0xe0 ? genl_op_lock.part.12+0x10/0x10 ? genl_dumpit+0x70/0x70 genl_rcv_msg+0x1d0/0x290 ? nl80211_del_station+0x330/0x330 [cfg80211] ? genl_get_cmd_both+0x50/0x50 netlink_rcv_skb+0x4f/0x100 genl_rcv+0x1f/0x30 netlink_unicast+0x1b6/0x260 netlink_sendmsg+0x31a/0x450 __sock_sendmsg+0xa8/0xb0 ____sys_sendmsg+0x1e4/0x260 ___sys_sendmsg+0x89/0xe0 ? local_clock_noinstr+0xb/0xc0 ? rcu_is_watching+0xd/0x40 ? kfree+0x1de/0x370 ? __sys_sendmsg+0x7a/0xc0
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 14, 2025 | Jul 10, 2025 |
| Suse | — | Upgrade dtb-rockchipUpgrade dtb-qcomUpgrade kselftests-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-rt-optionalUpgrade kernel-sourceUpgrade kernel-rtUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatchUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade kernel-default-vdsoUpgrade kernel-defaultUpgrade kernel-devel-azureUpgrade kernel-rt-vdsoUpgrade dlm-kmp-rtUpgrade gfs2-kmp-defaultUpgrade dtb-mediatekUpgrade dtb-amlogicUpgrade kernel-rt-extraUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-64kbUpgrade dtb-caviumUpgrade dtb-exynosUpgrade kernel-64kb-extraUpgrade kernel-azureUpgrade dtb-armUpgrade kernel-azure-develUpgrade kernel-default-baseUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-develUpgrade ocfs2-kmp-defaultUpgrade kernel-default-extraUpgrade dtb-socionextUpgrade kernel-kvmsmall-develUpgrade kernel-rt-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-azureUpgrade gfs2-kmp-rtUpgrade dtb-renesasUpgrade dtb-appleUpgrade dtb-apmUpgrade kernel-kvmsmallUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatch-develUpgrade dtb-hisiliconUpgrade dtb-freescaleUpgrade dtb-broadcomUpgrade kernel-64kb-optionalUpgrade kernel-obs-qaUpgrade ocfs2-kmp-64kbUpgrade kernel-develUpgrade dtb-xilinxUpgrade dtb-lgUpgrade gfs2-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-macrosUpgrade kernel-docs-htmlUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade dtb-marvellUpgrade dtb-amdUpgrade kernel-symsUpgrade kernel-default-optionalUpgrade kernel-default-develUpgrade kernel-obs-buildUpgrade kernel-zfcpdumpUpgrade kernel-default-livepatchUpgrade kernel-64kbUpgrade dtb-amazonUpgrade dtb-allwinnerUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-default | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-oem-24.04cUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-aws-64k-6.14Upgrade linux-image-realtime-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-raspi-6.14Upgrade linux-image-awsUpgrade linux-image-azureUpgrade linux-image-gcpUpgrade linux-image-oem-24.04aUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-6.14.0-1013-awsUpgrade linux-image-gcp-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-virtual-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-gcp-64kUpgrade linux-image-aws-6.14Upgrade linux-image-realtimeUpgrade linux-image-aws-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-oem-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-oem-24.04Upgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-32-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-genericUpgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-virtualUpgrade linux-image-oracle-64k-6.14 | Jul 14, 2025 | Jul 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub