LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38606: wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the radio object (ar) via arvif->deflink->ar. However, after commit aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO"), arvif is linked to a radio only after vdev creation, typically when a channel is assigned or a scan is requested. For P2P capable devices, a default P2P interface is created by wpa_supplicant along with regular station interfaces, these serve as dummy interfaces for P2P-capable stations, lack an associated netdev and initiate frequent scans to discover neighbor p2p devices. When a scan is initiated on such P2P vifs, driver selects destination radio (ar) based on scan frequency, creates a scan vdev, and attaches arvif to the radio. Once the scan completes or is aborted, the scan vdev is deleted, detaching arvif from the radio and leaving arvif->ar uninitialized. While handling beacon miss for station interfaces, P2P interface is also encountered in the vif iteration and ath12k_mac_handle_beacon_miss_iter() tries to dereference the uninitialized arvif->deflink->ar. Fix this by verifying that vdev is created for the arvif before accessing its ar during beacon miss handling and similar vif iterator callbacks. ========================================================================== wlp6s0: detected beacon loss from AP (missed 7 beacons) - probing KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt-ath+ #2 PREEMPT(full) RIP: 0010:ath12k_mac_handle_beacon_miss_iter+0xb5/0x1a0 [ath12k] Call Trace: __iterate_interfaces+0x11a/0x410 [mac80211] ieee80211_iterate_active_interfaces_atomic+0x61/0x140 [mac80211] ath12k_mac_handle_beacon_miss+0xa1/0xf0 [ath12k] ath12k_roam_event+0x393/0x560 [ath12k] ath12k_wmi_op_rx+0x1486/0x28c0 [ath12k] ath12k_htc_process_trailer.isra.0+0x2fb/0x620 [ath12k] ath12k_htc_rx_completion_handler+0x448/0x830 [ath12k] ath12k_ce_recv_process_cb+0x549/0x9e0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] process_one_work+0xe3a/0x1430 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-38606 is a Linux kernel ath12k Wi-Fi driver bug that can crash affected systems when beacon-miss handling touches an uninitialized radio pointer. It appears tied to Qualcomm ath12k hardware and P2P-capable Wi-Fi behavior. Public sources do not provide CVSS, KEV listing, or evidence of active exploitation.

Executive priority

Schedule remediation through normal kernel patch management, with higher priority for fleets relying on ath12k Wi-Fi. The available evidence supports operational disruption risk, not confirmed remote compromise or active exploitation.

Technical view

The ath12k driver may dereference arvif->deflink->ar after scan vdev teardown leaves the radio pointer uninitialized. Beacon-miss iteration over active interfaces can hit a P2P dummy interface without a created vdev, causing a null pointer dereference. The kernel fix checks vdev creation before accessing ar.

Likely exposure

Exposure is likely limited to Linux systems using ath12k-supported Qualcomm Wi-Fi devices with affected kernel builds, especially P2P-capable client configurations using wpa_supplicant. Servers without ath12k hardware or wireless client use are unlikely to be exposed.

Exploitation context

No cited source states active exploitation, and the CVE is not marked KEV. The public evidence describes a crash during normal driver event handling, not a documented weaponized attack path. Treat this primarily as a kernel availability risk until more evidence appears.

Researcher notes

The root cause follows commit aa80f12f3bed, which deferred vdev creation for MLO. The fix adds vdev-created checks before accessing arvif radio state in beacon-miss and similar vif iterator callbacks. Public data lacks CVSS, CWE, and exploitability detail.

Mitigation direction

  • Apply a kernel update containing the referenced stable ath12k fixes.
  • Check distribution or device-vendor advisories for backported kernel fixes.
  • Prioritize affected laptops, workstations, and appliances using ath12k Wi-Fi.
  • Avoid direct wrangler-style assumptions; validate fixes against your vendor kernel tree.
  • If patching is delayed, seek vendor guidance on temporary Wi-Fi exposure reduction.

Validation and detection

  • Inventory systems for Linux kernels with ath12k driver support enabled.
  • Confirm whether Qualcomm QCN9274, WCN7850, or similar ath12k hardware is present.
  • Compare deployed kernel source or changelog against the referenced stable commits.
  • Review kernel logs for ath12k beacon loss, roam events, or null pointer dereferences.
  • Test patched kernels in representative Wi-Fi and P2P client scenarios.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38606 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxaa80f12f3bedc2d73e4cc43554aee44c277cc938, aa80f12f3bedc2d73e4cc43554aee44c277cc938, aa80f12f3bedc2d73e4cc43554aee44c277cc938unaffected
LinuxLinux6.14, 0, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.