Mutex Locking Vulnerability in the Linux Kernel Affecting Wireless Communication

CVE-2025-38643

What is CVE-2025-38643?

A concurrency-related vulnerability exists in the Linux kernel's cfg80211 subsystem. The issue arises when the function cfg80211_check_and_end_cac() fails to ensure proper mutex acquisition before calling wdev_chandef(). As a result, the worker thread cfg80211_propagate_cac_done_wk() may be executed without holding the required lock, leading to potential race conditions, inconsistent behavior, and warning messages when certain tests are run. This vulnerability stresses the importance of robust locking mechanisms in wireless communication code paths.

References