From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DEE2029B8CE for ; Sat, 16 Aug 2025 10:58:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1755341896; cv=none; b=IsUea9K2hrYTA3ULTGefstM5TL5mMTiey23lUK7WKXJuDTKxW6YmkxajZSdqPn+VRdDO8IRzOt0eZVsv+Yer6rjgYl4kr3gqKCe+8LdoU3+RLdt1+UbkmRO1h/rA+26hjfLGWHBfbrzZ9tJUtWnv4sL7VNN+PKwn5MZuUxFz1wE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1755341896; c=relaxed/simple; bh=UXRRx1CWXzDLccrpPb38olyX7+vp1BFzi7mU2RCt+44=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Za1uee8d22BVehsOoh9uaIju8D+O1bg9YCGGQaSmSdWcGQTuh0sJ9Y12sypP5yi0I7zVqKIXHsoncEDduiCOuwE0v9ofXZoTfnji3jFElGXyyBBUNHSbrDNadY2o70UoDCsJAhZDKKYP+uG9wMikEcXohi1CwUISVSFjAcsKJlw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=icgvcJz2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="icgvcJz2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED69EC4CEEF; Sat, 16 Aug 2025 10:58:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1755341895; bh=UXRRx1CWXzDLccrpPb38olyX7+vp1BFzi7mU2RCt+44=; h=From:To:Cc:Subject:Date:Reply-to:From; b=icgvcJz214+CcOnpqK1u3E0e8QNjtNOk6dGZZnP0H6c16xCrCGuzF6wFfQH2nSaIW 5EIvR6Gn62+no6ZeS+M8BA9sICOweepNEKaSlfVLqox/psXn7/+wBw/JJRkPypoptS DnGCHRS9vf5OvMRizPh1oKCVA+y9R1kwh0Pk+fys= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-38513: wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() Date: Sat, 16 Aug 2025 12:57:55 +0200 Message-ID: <2025081652-CVE-2025-38513-e205@gregkh> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4231; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=I0mdQgWojYVy8/dxqpGV2p9A6YaVulhMfKLfHhkbZ1U=; b=owGbwMvMwCRo6H6F97bub03G02pJDBkLUgzmzXVimbk3lX+pWsUew7NfOVr7xCNrf1fsPH58m pidrpNqRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzkQjrDHL6FQe9S+SIW2Wz8 myi89vjbA9339BnmJ4V0xu/oEv/xcEOrmOpT7q9MC9vYAQ== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For example, the following is possible: T0 T1 zd_mac_tx_to_dev() /* len == skb_queue_len(q) */ while (len > ZD_MAC_MAX_ACK_WAITERS) { filter_ack() spin_lock_irqsave(&q->lock, flags); /* position == skb_queue_len(q) */ for (i=1; itype == NL80211_IFTYPE_AP) skb = __skb_dequeue(q); spin_unlock_irqrestore(&q->lock, flags); skb_dequeue() -> NULL Since there is a small gap between checking skb queue length and skb being unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL. Then the pointer is passed to zd_mac_tx_status() where it is dereferenced. In order to avoid potential NULL pointer dereference due to situations like above, check if skb is not NULL before passing it to zd_mac_tx_status(). Found by Linux Verification Center (linuxtesting.org) with SVACE. The Linux kernel CVE team has assigned CVE-2025-38513 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.25 with commit 459c51ad6e1fc19e91a53798358433d3c08cd09d and fixed in 5.4.296 with commit c1958270de947604cc6de05fc96dbba256b49cf0 Issue introduced in 2.6.25 with commit 459c51ad6e1fc19e91a53798358433d3c08cd09d and fixed in 5.10.240 with commit 014c34dc132015c4f918ada4982e952947ac1047 Issue introduced in 2.6.25 with commit 459c51ad6e1fc19e91a53798358433d3c08cd09d and fixed in 5.15.189 with commit b24f65c184540dfb967479320ecf7e8c2e9220dc Issue introduced in 2.6.25 with commit 459c51ad6e1fc19e91a53798358433d3c08cd09d and fixed in 6.1.146 with commit adf08c96b963c7cd7ec1ee1c0c556228d9bedaae Issue introduced in 2.6.25 with commit 459c51ad6e1fc19e91a53798358433d3c08cd09d and fixed in 6.6.99 with commit 5420de65efbeb6503bcf1d43451c9df67ad60298 Issue introduced in 2.6.25 with commit 459c51ad6e1fc19e91a53798358433d3c08cd09d and fixed in 6.12.39 with commit fcd9c923b58e86501450b9b442ccc7ce4a8d0fda Issue introduced in 2.6.25 with commit 459c51ad6e1fc19e91a53798358433d3c08cd09d and fixed in 6.15.7 with commit 602b4eb2f25668de15de69860ec99caf65b3684d Issue introduced in 2.6.25 with commit 459c51ad6e1fc19e91a53798358433d3c08cd09d and fixed in 6.16 with commit 74b1ec9f5d627d2bdd5e5b6f3f81c23317657023 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-38513 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/zydas/zd1211rw/zd_mac.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c1958270de947604cc6de05fc96dbba256b49cf0 https://git.kernel.org/stable/c/014c34dc132015c4f918ada4982e952947ac1047 https://git.kernel.org/stable/c/b24f65c184540dfb967479320ecf7e8c2e9220dc https://git.kernel.org/stable/c/adf08c96b963c7cd7ec1ee1c0c556228d9bedaae https://git.kernel.org/stable/c/5420de65efbeb6503bcf1d43451c9df67ad60298 https://git.kernel.org/stable/c/fcd9c923b58e86501450b9b442ccc7ce4a8d0fda https://git.kernel.org/stable/c/602b4eb2f25668de15de69860ec99caf65b3684d https://git.kernel.org/stable/c/74b1ec9f5d627d2bdd5e5b6f3f81c23317657023