CVE-2025-23133: wifi: ath11k: update channel list in reg notifier instead reg worker
Vulnerability summary
CVE-2025-23133 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 23.5% of scored vulnerabilities.
Not severe (CVSS 8.8, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 24 · Related 23Timeline
- 16-04-2025PublishedVulnerability first disclosed.
- 21-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: update channel list in reg notifier instead reg worker Currently when ath11k gets a new channel list, it will be processed according to the following steps: 1. update new channel list to cfg80211 and queue reg_work. 2. cfg80211 handles new channel list during reg_work. 3. update cfg80211's handled channel list to firmware by ath11k_reg_update_chan_list(). But ath11k will immediately execute step 3 after reg_work is just queued. Since step 2 is asynchronous, cfg80211 may not have completed handling the new channel list, which may leading to an out-of-bounds write error: BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list Call Trace: ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k] kfree+0x109/0x3a0 ath11k_regd_update+0x1cf/0x350 [ath11k] ath11k_regd_update_work+0x14/0x20 [ath11k] process_one_work+0xe35/0x14c0 Should ensure step 2 is completely done before executing step 3. Thus Wen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set, cfg80211 will notify ath11k after step 2 is done. So enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will notify ath11k after step 2 is done. At this time, there will be no KASAN bug during the execution of the step 3. [1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/ Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
Increase +0.05 pp
From 0.26% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu127 products
- linuxAll versions (No fix recorded) | < 6.8.0-106.106
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 6.8.0-1050.53
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ f45cb6b29cd36514e13f7519770873d8c0457008, < ec97bd5378c594be1f1c7a15dcf381e075b665d9 | ≥ f45cb6b29cd36514e13f7519770873d8c0457008, < 26618c039b78a76c373d4e02c5fbd52e3a73aead | ≥ f45cb6b29cd36514e13f7519770873d8c0457008, < f952fb83c9c6f908d27500764c4aee1df04b9d3f | ≥ f45cb6b29cd36514e13f7519770873d8c0457008, < 933ab187e679e6fbdeea1835ae39efcc59c022d2 | f96fd36936310cefe0ea1370a9ae30e6746e6f62 | c97b120950b49d76bdce013bd4d9577d769465f4 | ≥ 5.15.79, < 5.16 | ≥ 6.0.9, < 6.1 | 6.1
- linux_kernel≥ 5.15.79, < 5.16 | ≥ 6.0.9, < 6.1 | ≥ 6.1.1, < 6.12.46 | ≥ 6.13, < 6.14.2 | 6.1 | 6.1:rc5 | 6.1:rc6 | 6.1:rc7 | 6.1:rc8
Debian1 product
- linuxAll versions (No fix recorded) | < 6.12.48-1 | < 6.16.3-1
3 vendors · 130 products
