CVE-2025-39732

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable driver op is only reachable through local configuration interfaces — the nl80211 netlink command NL80211_CMD_SET_TX_BITRATE_MASK or the legacy WEXT SIOCSIWRATE ioctl on the wireless netdev. No received 802.11 frame or remote peer action can invoke ath11k_mac_op_set_bitrate_mask(), so the attack surface is local syscall/netlink only.

AC:LAttack complexity, low

The atomic-context violation is unconditional: every invocation of the affected branches runs a might_sleep()/wait_event_timeout() callback inside rcu_read_lock(), and the attacker fully controls the bitrate mask that selects those branches. Extending it to an actual block (and thus a grace-period-completing context switch) only requires having peers associated and saturating WMI credits, both of which the attacker can arrange.

PR:LPrivileges required, low

Both entry points gate on CAP_NET_ADMIN (GENL_UNS_ADMIN_PERM for nl80211, capable(CAP_NET_ADMIN) for WEXT), which is a namespace-aware network-administration capability rather than real root, and is routinely delegated to unprivileged-facing daemons (wpa_supplicant, NetworkManager helpers, hostapd) on phones, APs and embedded gateways.

UI:NUser interaction, none

The attacker performs the bitrate-mask configuration itself; no second user has to open a file, mount media, or take any action for the bug to fire.

S:UScope, unchanged

The fault, the corrupted RCU-protected station list, and the resulting crash all stay within the same kernel security authority on the host; no VM, IOMMU, container, or sandbox boundary is crossed.

C:HConfidentiality impact, high

Blocking for up to WMI_SEND_TIMEOUT_HZ inside the rcu_read_lock() of __iterate_stations() lets the grace period complete on non-preemptible-RCU builds, so a concurrently destroyed sta_info can be freed and reallocated while the iterator is parked on it; the resumed list_for_each_entry_rcu() then reads freed/attacker-groomed heap through sta->addr and the list pointers, leaking that content into the WMI peer command and the ath11k_warn("...for STA %pM") log line.

I:HIntegrity impact, high

The same use-after-free lets the traversal follow a dangling next pointer into reclaimed, attacker-sprayable memory and feed the resulting garbage into firmware peer-parameter commands, and __schedule_bug() additionally resets the preempt count, leaving the scheduler's atomic-nesting state inconsistent for the remainder of the task.

A:HAvailability impact, high

The bug reliably produces a "BUG: sleeping function called from invalid context" splat plus a scheduling-while-atomic BUG with full call trace, which escalates to a full panic on panic_on_warn/panic_on_oops kernels common in embedded and cloud images, and the RCU-list use-after-free can oops the kernel outright.