High 8.8Published Aug 19, 2025

CVE-2025-38601wifi: ath11k: clear initialized flag for deinit-ed srng lists

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. ath11k_pci 0000:01:00.0: Service connect timeout ath11k_pci 0000:01:00.0: failed to connect to HTT: -110 ath11k_pci 0000:01:00.0: failed to start core: -110 ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM ath11k_pci 0000:01:00.0: already resetting count 2 ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110 ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110 ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery [..] 2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit() which destroys srng lists. However, it does not reset per-list ->initialized flag. 3) Second ath11k_hal_dump_srng_stats() call sees stale ->initialized flag and attempts to dump srng stats: Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 66785ms before ath11k_pci 0000:01:00.0: group_id 1 14485062ms before ath11k_pci 0000:01:00.0: group_id 2 14485062ms before ath11k_pci 0000:01:00.0: group_id 3 14485062ms before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath11k_pci 0000:01:00.0: group_id 6 14485062ms before ath11k_pci 0000:01:00.0: group_id 7 66814ms before ath11k_pci 0000:01:00.0: group_id 8 68997ms before ath11k_pci 0000:01:00.0: group_id 9 67588ms before ath11k_pci 0000:01:00.0: group_id 10 69511ms before BUG: unable to handle page fault for address: ffffa007404eb010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 10022d067 PMD 100b01067 PTE 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k] Call Trace: <TASK> ? __die_body+0xae/0xb0 ? page_fault_oops+0x381/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k (HASH:6cea 4)] ath11k_qmi_driver_event_work+0xbd/0x1050 [ath11k (HASH:6cea 4)] worker_thread+0x389/0x930 kthread+0x149/0x170 Clear per-list ->initialized flag in ath11k_hal_srng_deinit().

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	5118935b1bc28d0bce9427e584e11e905e68ee9a builds before 3a6daae987a829534636fd85ed6f84d5f0ad7fa4; from 5118935b1bc28d0bce9427e584e11e905e68ee9a before eff3bb53c18c0ed4ab6f43d412b3ed3aecad52d5; 5118935b1bc28d0bce9427e584e11e905e68ee9a builds before 916ac18d526a26f6072866b1a97622cf1351ef1c; 5118935b1bc28d0bce9427e584e11e905e68ee9a builds before 5bf201c55fdf303e79005038648dfa1e8af48f54; 5118935b1bc28d0bce9427e584e11e905e68ee9a builds before 72a48be1f53942793f3bc68a37fad1f38b53b082; 5118935b1bc28d0bce9427e584e11e905e68ee9a builds before 0ebb5fe494501c19f31270008b26ab95201af6fd; from 5118935b1bc28d0bce9427e584e11e905e68ee9a before 16872194c80f2724472fc207991712895ac8a230; from 5118935b1bc28d0bce9427e584e11e905e68ee9a before a5b46aa7cf5f05c213316a018e49a8e086efd98e	CNA record
linux linux_kernel linux:linux_kernel	from 5.7 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.148; from 6.2 before 6.6.102; from 6.7 before 6.12.42; from 6.13 before 6.15.10; from 6.16 before 6.16.1	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

https://git.kernel.org/stable/c/3a6daae987a829534636fd85ed6f84d5f0ad7fa4patch
https://git.kernel.org/stable/c/eff3bb53c18c0ed4ab6f43d412b3ed3aecad52d5patch
https://git.kernel.org/stable/c/916ac18d526a26f6072866b1a97622cf1351ef1cpatch
https://git.kernel.org/stable/c/5bf201c55fdf303e79005038648dfa1e8af48f54patch
https://git.kernel.org/stable/c/72a48be1f53942793f3bc68a37fad1f38b53b082patch
https://git.kernel.org/stable/c/0ebb5fe494501c19f31270008b26ab95201af6fdpatch
https://git.kernel.org/stable/c/16872194c80f2724472fc207991712895ac8a230patch
https://git.kernel.org/stable/c/a5b46aa7cf5f05c213316a018e49a8e086efd98epatch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlthird-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.