{"id":"DEBIAN-CVE-2025-37794","details":"In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: Purge vif txq in ieee80211_do_stop()  After ieee80211_do_stop() SKB from vif's txq could still be processed. Indeed another concurrent vif schedule_and_wake_txq call could cause those packets to be dequeued (see ieee80211_handle_wake_tx_queue()) without checking the sdata current state.  Because vif.drv_priv is now cleared in this function, this could lead to driver crash.  For example in ath12k, ahvif is store in vif.drv_priv. Thus if ath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif-\u003eah can be NULL, leading the ath12k_warn(ahvif-\u003eah,...) call in this function to trigger the NULL deref below.    Unable to handle kernel paging request at virtual address dfffffc000000001   KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]   batman_adv: bat0: Interface deactivated: brbh1337   Mem abort info:     ESR = 0x0000000096000004     EC = 0x25: DABT (current EL), IL = 32 bits     SET = 0, FnV = 0     EA = 0, S1PTW = 0     FSC = 0x04: level 0 translation fault   Data abort info:     ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000     CM = 0, WnR = 0, TnD = 0, TagAccess = 0     GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0   [dfffffc000000001] address between user and kernel address ranges   Internal error: Oops: 0000000096000004 [#1] SMP   CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114   Hardware name: HW (DT)   pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)   pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k]   lr : ath12k_mac_op_tx+0x174/0x29b8 [ath12k]   sp : ffffffc086ace450   x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4   x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e   x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0   x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958   x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8   x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03   x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40   x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0   x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001   x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008   Call trace:    ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P)    ieee80211_handle_wake_tx_queue+0x16c/0x260    ieee80211_queue_skb+0xeec/0x1d20    ieee80211_tx+0x200/0x2c8    ieee80211_xmit+0x22c/0x338    __ieee80211_subif_start_xmit+0x7e8/0xc60    ieee80211_subif_start_xmit+0xc4/0xee0    __ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0    ieee80211_subif_start_xmit_8023+0x124/0x488    dev_hard_start_xmit+0x160/0x5a8    __dev_queue_xmit+0x6f8/0x3120    br_dev_queue_push_xmit+0x120/0x4a8    __br_forward+0xe4/0x2b0    deliver_clone+0x5c/0xd0    br_flood+0x398/0x580    br_dev_xmit+0x454/0x9f8    dev_hard_start_xmit+0x160/0x5a8    __dev_queue_xmit+0x6f8/0x3120    ip6_finish_output2+0xc28/0x1b60    __ip6_finish_output+0x38c/0x638    ip6_output+0x1b4/0x338    ip6_local_out+0x7c/0xa8    ip6_send_skb+0x7c/0x1b0    ip6_push_pending_frames+0x94/0xd0    rawv6_sendmsg+0x1a98/0x2898    inet_sendmsg+0x94/0xe0    __sys_sendto+0x1e4/0x308    __arm64_sys_sendto+0xc4/0x140    do_el0_svc+0x110/0x280    el0_svc+0x20/0x60    el0t_64_sync_handler+0x104/0x138    el0t_64_sync+0x154/0x158  To avoid that, empty vif's txq at ieee80211_do_stop() so no packet could be dequeued after ieee80211_do_stop() (new packets cannot be queued because SDATA_STATE_RUNNING is cleared at this point).","modified":"2026-09-01T16:06:12.848363859Z","published":"2025-05-01T14:15:43.913Z","upstream":["CVE-2025-37794"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-37794"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.135-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37794.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37794.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37794.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}