CVE-2025-68729
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix MSDU buffer types handling in RX error path Currently, packets received on the REO exception ring from unassociated peers are of MSDU buffer type, while the driver expects link descriptor type packets. These packets are not parsed further due to a return check on packet type in ath12k_hal_desc_reo_parse_err(), but the associated skb is not freed. This may lead to kernel crashes and buffer leaks. Hence to fix, update the RX error handler to explicitly drop MSDU buffer type packets received on the REO exception ring. This prevents further processing of invalid packets and ensures stability in the RX error handling path. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Severity
Not scored
CVSS score
Not available
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-12-24 11:16:02.200000
Last modified
2026-10-21 13:18:23.803000
View original CVE JSON
{
"id": "CVE-2025-68729",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-12-24T11:16:02.200",
"lastModified": "2026-10-21T13:18:23.803",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix MSDU buffer types handling in RX error path\n\nCurrently, packets received on the REO exception ring from\nunassociated peers are of MSDU buffer type, while the driver expects\nlink descriptor type packets. These packets are not parsed further due\nto a return check on packet type in ath12k_hal_desc_reo_parse_err(),\nbut the associated skb is not freed. This may lead to kernel\ncrashes and buffer leaks.\n\nHence to fix, update the RX error handler to explicitly drop\nMSDU buffer type packets received on the REO exception ring.\nThis prevents further processing of invalid packets and ensures\nstability in the RX error handling path.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1"
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: ath12k: Corrección del manejo de tipos de búfer MSDU en la ruta de error de RX\n\nActualmente, los paquetes recibidos en el anillo de excepción REO de pares no asociados son de tipo de búfer MSDU, mientras que el controlador espera paquetes de tipo descriptor de enlace. Estos paquetes no se analizan más debido a una verificación de retorno sobre el tipo de paquete en ath12k_hal_desc_reo_parse_err(), pero el skb asociado no se libera. Esto puede llevar a fallos del kernel y fugas de búfer.\n\nPor lo tanto, para corregir, actualice el gestor de errores de RX para descartar explícitamente los paquetes de tipo de búfer MSDU recibidos en el anillo de excepción REO. Esto evita el procesamiento posterior de paquetes inválidos y asegura la estabilidad en la ruta de manejo de errores de RX.\n\nProbado en: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1"
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/wireless/ath/ath12k/dp_rx.c",
"drivers/net/wireless/ath/ath12k/hal_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"lessThan": "abfbceda0d2391524ad1df88867b3f3af36d17c7",
"versionType": "git",
"status": "affected"
},
{
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"lessThan": "17a9b93283c6f0b799a338bbc50fa115012429d9",
"versionType": "git",
"status": "affected"
},
{
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"lessThan": "5ff5a9d71cdc49c3400f30583a784ad0a17d01ec",
"versionType": "git",
"status": "affected"
},
{
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"lessThan": "ab0554f51e5f2b9506e8a09e8accd02f00056729",
"versionType": "git",
"status": "affected"
},
{
"version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
"lessThan": "36f9edbb9d0fc36c865c74f3c1ad8e1261ad3981",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/wireless/ath/ath12k/dp_rx.c",
"drivers/net/wireless/ath/ath12k/hal_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.3",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.3",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.114",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.13",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.2",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/17a9b93283c6f0b799a338bbc50fa115012429d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/36f9edbb9d0fc36c865c74f3c1ad8e1261ad3981",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5ff5a9d71cdc49c3400f30583a784ad0a17d01ec",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ab0554f51e5f2b9506e8a09e8accd02f00056729",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/abfbceda0d2391524ad1df88867b3f3af36d17c7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}