Skip to content
OpenAdvisories
Unscored CVE-2022-50187 EUVD-2022-55451GHSA-qx85-gr6x-6vqf

ath11k: fix netdev open race

Published Jun 18, 2025 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

ath11k: fix netdev open race

Make sure to allocate resources needed before registering the device.

This specifically avoids having a racing open() trigger a BUG_ON() in
mod_timer() when ath11k_mac_op_start() is called before the
mon_reap_timer as been set up.

I did not see this issue with next-20220310, but I hit it on every probe
with next-20220511. Perhaps some timing changed in between.

Here's the backtrace:

[ 51.346947] kernel BUG at kernel/time/timer.c:990!
[ 51.346958] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
...
[ 51.578225] Call trace:
[ 51.583293] __mod_timer+0x298/0x390
[ 51.589518] mod_timer+0x14/0x20
[ 51.595368] ath11k_mac_op_start+0x41c/0x4a0 [ath11k]
[ 51.603165] drv_start+0x38/0x60 [mac80211]
[ 51.610110] ieee80211_do_open+0x29c/0x7d0 [mac80211]
[ 51.617945] ieee80211_open+0x60/0xb0 [mac80211]
[ 51.625311] __dev_open+0x100/0x1c0
[ 51.631420] __dev_change_flags+0x194/0x210
[ 51.638214] dev_change_flags+0x24/0x70
[ 51.644646] do_setlink+0x228/0xdb0
[ 51.650723] __rtnl_newlink+0x460/0x830
[ 51.657162] rtnl_newlink+0x4c/0x80
[ 51.663229] rtnetlink_rcv_msg+0x124/0x390
[ 51.669917] netlink_rcv_skb+0x58/0x130
[ 51.676314] rtnetlink_rcv+0x18/0x30
[ 51.682460] netlink_unicast+0x250/0x310
[ 51.688960] netlink_sendmsg+0x19c/0x3e0
[ 51.695458] ____sys_sendmsg+0x220/0x290
[ 51.701938] ___sys_sendmsg+0x7c/0xc0
[ 51.708148] __sys_sendmsg+0x68/0xd0
[ 51.714254] __arm64_sys_sendmsg+0x28/0x40
[ 51.720900] invoke_syscall+0x48/0x120

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3

Affected products

VendorProductAffectedFixed
Linux Linux 5.6 5.10.137

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.0.2-1 —
Debian 13 linux 6.0.2-1 —
Debian 12 linux 6.0.2-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-riscv +2 No fix yet —
Ubuntu 22.04 LTS linux +1 5.15.0-53.59 —
Ubuntu 22.04 LTS linux-aws 5.15.0-1023.27 —
Ubuntu 22.04 LTS linux-azure 5.15.0-1023.29 —
Ubuntu 22.04 LTS linux-azure-fde 5.15.0-1024.30.1 —
Ubuntu 22.04 LTS linux-gcp 5.15.0-1022.29 —
Ubuntu 22.04 LTS linux-gke 5.15.0-1020.25 —
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1008.12 —
Ubuntu 22.04 LTS linux-ibm 5.15.0-1018.21 —
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1018.23 —
Ubuntu 22.04 LTS linux-kvm 5.15.0-1021.26 —
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1015.15 —
Ubuntu 22.04 LTS linux-oracle 5.15.0-1022.28 —
Ubuntu 22.04 LTS linux-raspi 5.15.0-1018.20 —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-aws-5.15 +1 5.15.0-1023.27~20.04.1 —
Ubuntu 20.04 LTS linux-azure-5.15 5.15.0-1023.29~20.04.1 —
Ubuntu 20.04 LTS linux-gcp-5.15 5.15.0-1022.29~20.04.1 —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 20.04 LTS linux-hwe-5.15 +1 5.15.0-53.59~20.04.1 —
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1018.23~20.04.1 —
Ubuntu 20.04 LTS linux-oracle-5.15 5.15.0-1022.28~20.04.1 —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro Realtime 22.04 LTS linux-realtime 5.15.0-1025.28 —
ReleasePackageFixed inAdvisory
RHEL 9 perf +29 5.14.0-162.6.1.el9_1 RHSA-2022:8267
RHEL 8 perf +26 4.18.0-425.3.1.el8 RHSA-2022:7683
ReleasePackageFixed inAdvisory
SLES 15 SP5 kernel-64kb +6 5.14.21-150500.55.113.1 SUSE-SU-2025:02264-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.113.1.150500.6.53.1 SUSE-SU-2025:02264-1
SLES 15 SP4 kernel-64kb +3 5.14.21-150400.24.170.2 SUSE-SU-2025:02537-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.170.2.150400.24.86.2 SUSE-SU-2025:02537-1
SLES 15 SP4 kernel-docs +2 5.14.21-150400.24.170.1 SUSE-SU-2025:02537-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 kernel-default-base 5.14.21-150500.55.113.1.150500.6.53.1 SUSE-SU-2025:02264-1
SLES for SAP 15 SP5 kernel-docs +4 5.14.21-150500.55.113.1 SUSE-SU-2025:02264-1
SLES for SAP 15 SP4 kernel-default +1 5.14.21-150400.24.170.2 SUSE-SU-2025:02537-1
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.170.2.150400.24.86.2 SUSE-SU-2025:02537-1
SLES for SAP 15 SP4 kernel-docs +2 5.14.21-150400.24.170.1 SUSE-SU-2025:02537-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.113.1.150500.6.53.1 SUSE-SU-2025:02264-1
SLE Micro 5.5 kernel-rt 5.14.21-150500.13.100.2 SUSE-SU-2025:02321-1
SLE Micro 5.5 kernel-source +1 5.14.21-150500.55.113.1 SUSE-SU-2025:02264-1
SLE Micro 5.5 kernel-source-rt 5.14.21-150500.13.100.1 SUSE-SU-2025:02321-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.170.2 SUSE-SU-2025:02537-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.170.2.150400.24.86.2 SUSE-SU-2025:02537-1
SLE Micro 5.4 kernel-rt +1 5.14.21-150400.15.124.1 SUSE-SU-2025:02322-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.170.2 SUSE-SU-2025:02537-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.170.2.150400.24.86.2 SUSE-SU-2025:02537-1
SLE Micro 5.3 kernel-rt +1 5.14.21-150400.15.124.1 SUSE-SU-2025:02322-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.113.1 SUSE-SU-2025:02264-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_28 1-150500.11.3.1 SUSE-SU-2025:02264-1
SLE HPC 15 SP5 kernel-64kb +5 5.14.21-150500.55.113.1 SUSE-SU-2025:02264-1
SLE HPC 15 SP5 kernel-default-base 5.14.21-150500.55.113.1.150500.6.53.1 SUSE-SU-2025:02264-1
SLE HPC 15 SP4 kernel-64kb +2 5.14.21-150400.24.170.2 SUSE-SU-2025:02537-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.170.2.150400.24.86.2 SUSE-SU-2025:02537-1
SLE HPC 15 SP4 kernel-docs +2 5.14.21-150400.24.170.1 SUSE-SU-2025:02537-1
SUSE Manager Server 4.3 kernel-default +1 5.14.21-150400.24.170.2 SUSE-SU-2025:02537-1
SUSE Manager Server 4.3 kernel-default-base 5.14.21-150400.24.170.2.150400.24.86.2 SUSE-SU-2025:02537-1
SUSE Manager Server 4.3 kernel-syms +1 5.14.21-150400.24.170.1 SUSE-SU-2025:02537-1
SUSE Manager Proxy 4.3 kernel-default 5.14.21-150400.24.170.2 SUSE-SU-2025:02537-1
SUSE Manager Proxy 4.3 kernel-default-base 5.14.21-150400.24.170.2.150400.24.86.2 SUSE-SU-2025:02537-1
SUSE Manager Proxy 4.3 kernel-syms +1 5.14.21-150400.24.170.1 SUSE-SU-2025:02537-1

Advisories 7

References