CVE-2025-23133

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The trigger is an 802.11d Country IE in beacons/probe responses harvested by the firmware's periodic 11d offload scan, which drives `WMI_11D_NEW_COUNTRY_EVENTID` → `ath11k_reg_set_cc()` → `WMI_REG_CHAN_LIST_CC_EVENTID` → `ath11k_regd_update_work`. This requires only RF proximity to the victim's Wi-Fi radio, matching the adjacent-network scope for Wi-Fi frame injection.

AC:LAttack complexity, low

The attacker initiates both racing workers with a single beaconed country change — `ath11k_regd_update_work` on the ath11k workqueue and cfg80211's `reg_work` on the system workqueue — and the window is widened by the sleeping `kzalloc(GFP_KERNEL)` and per-channel `ath11k_dbg()` calls between the counting and filling loops. Since 11d scans repeat on a fixed interval and the attacker can toggle the advertised country indefinitely, the race can be retried until won.

PR:NPrivileges required, none

No credentials, association, or authentication are needed — the firmware's 11d scan ingests Country IEs from unassociated broadcast beacons of any AP in range. No local account on the victim is involved at any point in the path.

UI:NUser interaction, none

A station interface that is simply up and scanning (the normal state for a laptop, phone, or embedded client) runs the 11d scan automatically; no user action such as connecting to the rogue AP is required. The regdomain update and the racing workers are entirely kernel-internal once the beacon is received.

S:UScope, unchanged

The out-of-bounds write corrupts kernel slab memory adjacent to the `scan_chan_list_params` allocation, staying within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

A heap out-of-bounds write of up to ~1–2 KB of `struct channel_param` records overwrites adjacent slab objects, which can be groomed (e.g. onto neighboring length or pointer fields) to yield an information-disclosure primitive. Per kernel scoring guidance, memory corruption that can be leveraged for disclosure rates High.

I:HIntegrity impact, high

This is a genuine slab out-of-bounds write with attacker-influenced length (via race timing over which bands cfg80211 has re-enabled) and partially attacker-influenced contents (`mhz`, `cfreq1`, `maxpower`, `maxregpower`, `antennamax` derived from the attacker-chosen regdomain). Out-of-bounds writes into adjacent heap objects are a standard route to control-flow hijack and rate High.

A:HAvailability impact, high

The bug was found as a KASAN slab-out-of-bounds report followed by heap corruption at `kfree()`, which reliably produces oopses/panics on hardened or SLUB-debug kernels and unpredictable kernel state otherwise. Any such crash of the kernel is a full availability loss.