Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-38513

wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For example, the following is possible: T0 T1 zd_mac_tx_to_dev() /* len == skb_queue_len(q) */ while (len > ZD_MAC_MAX_ACK_WAITERS) { filter_ack() spin_lock_irqsave(&q->lock, flags); /* position == skb_queue_len(q) */ for (i=1; i<position; i++) skb = __skb_dequeue(q) if (mac->type == NL80211_IFTYPE_AP) skb = __skb_dequeue(q); spin_unlock_irqrestore(&q->lock, flags); skb_dequeue() -> NULL Since there is a small gap between checking skb queue length and skb being unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL. Then the pointer is passed to zd_mac_tx_status() where it is dereferenced. In order to avoid potential NULL pointer dereference due to situations like above, check if skb is not NULL before passing it to zd_mac_tx_status(). Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 459c51ad6e1fc19e91a53798358433d3c08cd09d to < c1958270de947604cc6de05fc96dbba256b49cf0affected
  • 459c51ad6e1fc19e91a53798358433d3c08cd09d to < 014c34dc132015c4f918ada4982e952947ac1047affected
  • 459c51ad6e1fc19e91a53798358433d3c08cd09d to < b24f65c184540dfb967479320ecf7e8c2e9220dcaffected
  • 459c51ad6e1fc19e91a53798358433d3c08cd09d to < adf08c96b963c7cd7ec1ee1c0c556228d9bedaaeaffected
  • 459c51ad6e1fc19e91a53798358433d3c08cd09d to < 5420de65efbeb6503bcf1d43451c9df67ad60298affected
  • 459c51ad6e1fc19e91a53798358433d3c08cd09d to < fcd9c923b58e86501450b9b442ccc7ce4a8d0fdaaffected
  • 459c51ad6e1fc19e91a53798358433d3c08cd09d to < 602b4eb2f25668de15de69860ec99caf65b3684daffected
  • 459c51ad6e1fc19e91a53798358433d3c08cd09d to < 74b1ec9f5d627d2bdd5e5b6f3f81c23317657023affected

Linux Linux

Default version status: affected

  • 2.6.25affected
  • 0 to < 2.6.25unaffected
  • 5.4.296 to ≤ 5.4.*unaffected
  • 5.10.240 to ≤ 5.10.*unaffected
  • 5.15.189 to ≤ 5.15.*unaffected
  • 6.1.146 to ≤ 6.1.*unaffected
  • 6.6.99 to ≤ 6.6.*unaffected
  • 6.12.39 to ≤ 6.12.*unaffected
  • 6.15.7 to ≤ 6.15.*unaffected
  • 6.16 to ≤ *unaffected

References