GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-23129 (GCVE-0-2025-23129)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:13 – Updated: 2026-09-14 11:57
VLAI
Title
wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right after the allocation of IRQ vectors in ath11k_pci_alloc_msi(). This does no harm unless one of the functions requesting the IRQ fails and attempt to free the IRQ. This results in the below warning: WARNING: CPU: 7 PID: 349 at kernel/irq/manage.c:1929 free_irq+0x278/0x29c Call trace: free_irq+0x278/0x29c ath11k_pcic_free_irq+0x70/0x10c [ath11k] ath11k_pci_probe+0x800/0x820 [ath11k_pci] local_pci_probe+0x40/0xbc The warning is due to not clearing the affinity hint before freeing the IRQs. So to fix this issue, clear the IRQ affinity hint before calling ath11k_pcic_free_irq() in the error path. The affinity will be cleared once again further down the error path due to code organization, but that does no harm. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e01b3400d641cb290742849331f0d22e1202538a , < 8d0519f511d93d675f61d6bfb45ffcc945af4b14 (git)
Affected: d412d0ef300f28d698648cc7c19147ab413251fe , < 7493b9baf0e54b44caae46715aaa409a84bd9f4b (git)
Affected: 39564b475ac5a589e6c22c43a08cbd283c295d2c , < 80dc5a2ce5b75d648e08549617f5c555d07ae43c (git)
Affected: 39564b475ac5a589e6c22c43a08cbd283c295d2c , < 3fc42cfcc6e336f25dee79b34e57c4a63cd652a5 (git)
Affected: 39564b475ac5a589e6c22c43a08cbd283c295d2c , < 68410c5bd381a81bcc92b808e7dc4e6b9ed25d11 (git)
Affected: 5a9f55efa9333e3edb4826d945cfdd8356f6e269 (git)
Affected: 6.1.63 , < 6.1.188 (semver)
Affected: 6.6.2 , < 6.6.157 (semver)
Affected: 6.5.12 , < 6.6 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.59 , ≤ 6.12.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8d0519f511d93d675f61d6bfb45ffcc945af4b14",
              "status": "affected",
              "version": "e01b3400d641cb290742849331f0d22e1202538a",
              "versionType": "git"
            },
            {
              "lessThan": "7493b9baf0e54b44caae46715aaa409a84bd9f4b",
              "status": "affected",
              "version": "d412d0ef300f28d698648cc7c19147ab413251fe",
              "versionType": "git"
            },
            {
              "lessThan": "80dc5a2ce5b75d648e08549617f5c555d07ae43c",
              "status": "affected",
              "version": "39564b475ac5a589e6c22c43a08cbd283c295d2c",
              "versionType": "git"
            },
            {
              "lessThan": "3fc42cfcc6e336f25dee79b34e57c4a63cd652a5",
              "status": "affected",
              "version": "39564b475ac5a589e6c22c43a08cbd283c295d2c",
              "versionType": "git"
            },
            {
              "lessThan": "68410c5bd381a81bcc92b808e7dc4e6b9ed25d11",
              "status": "affected",
              "version": "39564b475ac5a589e6c22c43a08cbd283c295d2c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a9f55efa9333e3edb4826d945cfdd8356f6e269",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.63",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.63",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.59",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path\n\nIf a shared IRQ is used by the driver due to platform limitation, then the\nIRQ affinity hint is set right after the allocation of IRQ vectors in\nath11k_pci_alloc_msi(). This does no harm unless one of the functions\nrequesting the IRQ fails and attempt to free the IRQ. This results in the\nbelow warning:\n\nWARNING: CPU: 7 PID: 349 at kernel/irq/manage.c:1929 free_irq+0x278/0x29c\nCall trace:\n free_irq+0x278/0x29c\n ath11k_pcic_free_irq+0x70/0x10c [ath11k]\n ath11k_pci_probe+0x800/0x820 [ath11k_pci]\n local_pci_probe+0x40/0xbc\n\nThe warning is due to not clearing the affinity hint before freeing the\nIRQs.\n\nSo to fix this issue, clear the IRQ affinity hint before calling\nath11k_pcic_free_irq() in the error path. The affinity will be cleared once\nagain further down the error path due to code organization, but that does\nno harm.\n\nTested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:57:57.901Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8d0519f511d93d675f61d6bfb45ffcc945af4b14"
        },
        {
          "url": "https://git.kernel.org/stable/c/7493b9baf0e54b44caae46715aaa409a84bd9f4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/80dc5a2ce5b75d648e08549617f5c555d07ae43c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fc42cfcc6e336f25dee79b34e57c4a63cd652a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/68410c5bd381a81bcc92b808e7dc4e6b9ed25d11"
        }
      ],
      "title": "wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-23129",
    "datePublished": "2025-04-16T14:13:11.663Z",
    "dateReserved": "2025-01-11T14:28:41.510Z",
    "dateUpdated": "2026-09-14T11:57:57.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-23129",
      "date": "2026-09-19",
      "epss": "0.00189",
      "percentile": "0.08847"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath11k/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8d0519f511d93d675f61d6bfb45ffcc945af4b14",
                    "status": "affected",
                    "version": "e01b3400d641cb290742849331f0d22e1202538a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7493b9baf0e54b44caae46715aaa409a84bd9f4b",
                    "status": "affected",
                    "version": "d412d0ef300f28d698648cc7c19147ab413251fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "80dc5a2ce5b75d648e08549617f5c555d07ae43c",
                    "status": "affected",
                    "version": "39564b475ac5a589e6c22c43a08cbd283c295d2c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3fc42cfcc6e336f25dee79b34e57c4a63cd652a5",
                    "status": "affected",
                    "version": "39564b475ac5a589e6c22c43a08cbd283c295d2c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "68410c5bd381a81bcc92b808e7dc4e6b9ed25d11",
                    "status": "affected",
                    "version": "39564b475ac5a589e6c22c43a08cbd283c295d2c",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "5a9f55efa9333e3edb4826d945cfdd8356f6e269",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.188",
                    "status": "affected",
                    "version": "6.1.63",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.157",
                    "status": "affected",
                    "version": "6.6.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "affected",
                    "version": "6.5.12",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath11k/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C1939E82-B0E6-4502-A05A-A40B2F7C52C6",
                    "versionEndExcluding": "6.2",
                    "versionStartIncluding": "6.1.63",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AFD63F94-BD00-4EF2-9873-45E8DED18B9A",
                    "versionEndExcluding": "6.6",
                    "versionStartIncluding": "6.5.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E75B3DC3-3295-436C-8311-B44FBD016BB8",
                    "versionEndExcluding": "6.14.2",
                    "versionStartIncluding": "6.6.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path\n\nIf a shared IRQ is used by the driver due to platform limitation, then the\nIRQ affinity hint is set right after the allocation of IRQ vectors in\nath11k_pci_alloc_msi(). This does no harm unless one of the functions\nrequesting the IRQ fails and attempt to free the IRQ. This results in the\nbelow warning:\n\nWARNING: CPU: 7 PID: 349 at kernel/irq/manage.c:1929 free_irq+0x278/0x29c\nCall trace:\n free_irq+0x278/0x29c\n ath11k_pcic_free_irq+0x70/0x10c [ath11k]\n ath11k_pci_probe+0x800/0x820 [ath11k_pci]\n local_pci_probe+0x40/0xbc\n\nThe warning is due to not clearing the affinity hint before freeing the\nIRQs.\n\nSo to fix this issue, clear the IRQ affinity hint before calling\nath11k_pcic_free_irq() in the error path. The affinity will be cleared once\nagain further down the error path due to code organization, but that does\nno harm.\n\nTested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath11k: Borrar la indicaci\u00f3n de afinidad antes de llamar a ath11k_pcic_free_irq() en la ruta de error. Si el controlador utiliza una IRQ compartida debido a una limitaci\u00f3n de la plataforma, la indicaci\u00f3n de afinidad de IRQ se establece justo despu\u00e9s de la asignaci\u00f3n de vectores IRQ en ath11k_pci_alloc_msi(). Esto no causa ning\u00fan problema a menos que una de las funciones que solicita la IRQ falle e intente liberarla. Esto da como resultado la siguiente advertencia: ADVERTENCIA: CPU: 7 PID: 349 en kernel/irq/manage.c:1929 free_irq+0x278/0x29c Rastreo de llamadas: free_irq+0x278/0x29c ath11k_pcic_free_irq+0x70/0x10c [ath11k] ath11k_pci_probe+0x800/0x820 [ath11k_pci] local_pci_probe+0x40/0xbc La advertencia se debe a que no se borra la sugerencia de afinidad antes de liberar las IRQ. Por lo tanto, para solucionar este problema, borre la sugerencia de afinidad de IRQ antes de llamar a ath11k_pcic_free_irq() en la ruta de error. La afinidad se borrar\u00e1 una vez m\u00e1s m\u00e1s adelante en la ruta de error debido a la organizaci\u00f3n del c\u00f3digo, pero eso no hace da\u00f1o. Probado en: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1"
          }
        ],
        "id": "CVE-2025-23129",
        "lastModified": "2026-09-14T12:17:35.680",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-04-16T15:16:07.373",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3fc42cfcc6e336f25dee79b34e57c4a63cd652a5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/68410c5bd381a81bcc92b808e7dc4e6b9ed25d11"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7493b9baf0e54b44caae46715aaa409a84bd9f4b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/80dc5a2ce5b75d648e08549617f5c555d07ae43c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8d0519f511d93d675f61d6bfb45ffcc945af4b14"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:18:31+00:00",
      "cve": "CVE-2025-23129",
      "id": "CVE-2025-23129",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-23129.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T02:20:25Z",
      "cve": "CVE-2025-23129",
      "id": "CVE-2025-23129",
      "initial_release_date": "2025-04-24T03:25:05Z",
      "product_status:known_affected": "461",
      "product_status:known_not_affected": "374",
      "product_status:recommended": "490",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-23129",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-23129.json",
      "version": "43"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.