CVE-2025-38116 — wifi: ath12k: fix uaf in ath12k_core_init()

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix uaf in ath12k_core_init()

When the execution of ath12k_core_hw_group_assign() or
ath12k_core_hw_group_create() fails, the registered notifier chain is not
unregistered properly. Its memory is freed after rmmod, which may trigger
to a use-after-free (UAF) issue if there is a subsequent access to this
notifier chain.

Fixes the issue by calling ath12k_core_panic_notifier_unregister() in
failure cases.

Call trace:
notifier_chain_register+0x4c/0x1f0 (P)
atomic_notifier_chain_register+0x38/0x68
ath12k_core_init+0x50/0x4e8 [ath12k]
ath12k_pci_probe+0x5f8/0xc28 [ath12k]
pci_device_probe+0xbc/0x1a8
really_probe+0xc8/0x3a0
__driver_probe_device+0x84/0x1b0
driver_probe_device+0x44/0x130
__driver_attach+0xcc/0x208
bus_for_each_dev+0x84/0x100
driver_attach+0x2c/0x40
bus_add_driver+0x130/0x260
driver_register+0x70/0x138
__pci_register_driver+0x68/0x80
ath12k_pci_init+0x30/0x68 [ath12k]
ath12k_init+0x28/0x78 [ath12k]

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

Affected products

Vendor	Product	Affected	Fixed
Linux	Linux	6.14	6.15.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 25.10	linux-azure-fde	No fix yet	—
Ubuntu 25.04	linux-azure	6.14.0-1012.12	USN-7770-1
Ubuntu 25.04	linux-raspi	6.14.0-1014.14	USN-7789-2
Ubuntu 24.04 LTS	linux-aws-6.14 +1	6.14.0-1013.13~24.04.1	USN-7789-1, USN-7769-3
Ubuntu 24.04 LTS	linux-azure-nvidia-6.14	6.14.0-1007.7	—
Ubuntu 24.04 LTS	linux-gcp-6.14	6.14.0-1016.17~24.04.1	USN-7769-1
Ubuntu 24.04 LTS	linux-hwe-6.14	6.14.0-32.32~24.04.1	USN-7769-3
Ubuntu 24.04 LTS	linux-oem-6.14	6.14.0-1012.12	USN-7771-1
Ubuntu 24.04 LTS	linux-riscv +6	No fix yet	—
Ubuntu 24.04 LTS	linux-riscv-6.14	6.14.0-32.32.1~24.04.1	—
Ubuntu 22.04 LTS	linux-riscv +32	No fix yet	—
Ubuntu 20.04 LTS	linux-gke +28	No fix yet	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	linux-gcp +14	No fix yet	—
Ubuntu 16.04 LTS	linux-hwe-edge	No fix yet	—
Ubuntu Pro Realtime 24.04 LTS	linux-realtime-6.14	6.14.0-1012.12~24.04.1	USN-7769-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	rv +76	6.12.0-124.8.1.el10_1	RHSA-2025:20095
RHEL 9	rv +75	5.14.0-611.5.1.el9_7	RHSA-2025:20518

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	rv +74	6.12.0-124.8.1.el10_1	ALSA-2025:20095
AlmaLinux 9	rv +73	5.14.0-611.5.1.el9_7	ALSA-2025:20518

Rocky Linux