Security readout for executives and security teams
Plain-English summary
A flaw in the Linux ath12k Wi-Fi driver can mishandle unusually long native Wi-Fi packets, causing invalid memory access and corruption. A nearby wireless source could potentially trigger it without credentials or user action. Systems not using ath12k are unlikely to be exposed through this code path.
Executive priority
Treat this as a high-priority patching issue for Linux endpoints or appliances using ath12k Wi-Fi. Prioritize exposed wireless systems and safety- or availability-critical devices. Lower the priority for systems where ath12k is absent or unused, while documenting that determination.
Technical view
ath12k_dp_rx_h_undecap_nwifi processes hardware-provided packets without adequately validating native Wi-Fi header length. An excessive length can make the function access or modify invalid header fields, potentially corrupting kernel memory. The upstream correction adds a sanity check before processing the socket buffer.
Likely exposure
Exposure requires a Linux system using the affected ath12k driver and relevant Qualcomm Wi-Fi hardware. The CVSS adjacent-network rating limits the likely attack path to nearby wireless access. The supplied affected-version data lists several kernel releases, but does not provide sufficiently clear branch boundaries for reliable version-only conclusions.
Exploitation context
The supplied CVSS is 8.8, with adjacent-network access, low complexity, no privileges, and no user interaction. CISA KEV status is false, and the source bundle provides no evidence of active exploitation or a public exploit. Memory corruption creates serious potential impact, but practical exploitability is not established here.
Researcher notes
The defect concerns length validation in the native Wi-Fi receive undecapsulation path. Review the referenced stable commits to identify the correct fix for each maintained branch. The bundle reports testing on QCN9274 hw2.0, but that does not prove exposure is limited to this device. Avoid inferring exploitability from the CVSS score alone.
Mitigation direction
- Apply a distribution or vendor kernel update containing the applicable upstream stable fix.
- Prioritize systems using ath12k with supported Qualcomm Wi-Fi hardware and adjacent wireless exposure.
- If updating is delayed, check vendor guidance for supported temporary risk-reduction measures.
- Monitor Linux and distribution advisories for precise affected-version guidance.
Validation and detection
- Inventory kernel versions, ath12k module presence, and active Qualcomm Wi-Fi interfaces.
- Confirm the installed kernel contains the applicable stable fix referenced by the CVE record.
- Review kernel logs for ath12k crashes, memory faults, or unexplained wireless instability.
- Test updates in an authorized lab and confirm normal Wi-Fi operation afterward.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37943 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7f1d986da5c6abb75ffe4d0d325fc9b341c41a1cCVE reference, Linux
- https://git.kernel.org/stable/c/3abe15e756481c45f6acba3d476cb3ca4afc3b61CVE reference, Linux
- https://git.kernel.org/stable/c/6ee653194ddb83674913fd2727b8ecfae0597adeCVE reference, Linux
- https://git.kernel.org/stable/c/50be1fb76556e80af9f5da80f28168b6c71bce58CVE reference, Linux
- https://git.kernel.org/stable/c/9a0dddfb30f120db3851627935851d262e4e7acbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.