CVE-2025-38293

A flaw was found in the Linux kernel's ath11k Wi-Fi (WLAN) driver, which ships in the kernel and kernel-rt packages of Red Hat Enterprise Linux 8, 9, and 10. In the WLAN recovery code flow, ath11k_core_halt() reinitializes only the head of the "arvifs" list, which can leave the list node immediately following the head in an invalid state. If a WLAN recovery occurs while a virtual interface (vif) is being removed, list_del() in ath11k_mac_op_remove_interface() detects this list corruption and triggers a kernel panic. A local attacker who can time a WLAN recovery with virtual interface removal, for example while bringing a wireless interface down, could crash the system, resulting in a denial of service; there is no impact to confidentiality or integrity. The vulnerable ath11k driver code is not present in RHEL 6, RHEL 7, or Red Hat In-Vehicle OS 1, so those products are not affected. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and low privileges and results only in loss of availability; this differs from the CVE.org score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which assumes an adjacent-network attack vector and confidentiality and integrity impact that the code analysis does not support. Fixes for the affected RHEL kernel and kernel-rt streams are currently deferred given the moderate severity, the local access and timing requirements, and the availability-only impact; the residual risk is limited to a local denial of service on systems using affected Qualcomm ath11k Wi-Fi hardware.