# CVE-2025-39732: wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()

> A bug in the ath11k Wi-Fi driver causes a kernel crash when setting bitrate masks, leading to a denial of service.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 7 Sep 2025
- **Updated:** 21 Oct 2026
- **Also known as:** BELL-CVE-2025-39732, DEBIAN-CVE-2025-39732, GHSA-5vxv-jx6g-44wr, ROOT-OS-DEBIAN-11-CVE-2025-39732, ROOT-OS-DEBIAN-12-CVE-2025-39732, ROOT-OS-UBUNTU-2204-CVE-2025-39732, ROOT-OS-UBUNTU-2404-CVE-2025-39732, UBUNTU-CVE-2025-39732

## What is CVE-2025-39732?

CVE-2025-39732 is a high-severity denial of service vulnerability in Linux kernel, published on 7 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()

ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to
ieee80211_iterate_stations_atomic(). Note in this case the iterator is
required to be atomic, however ath11k_mac_disable_peer_fixed_rate() does
not follow it as it might sleep. Consequently below warning is seen:

BUG: sleeping function called from invalid context at wmi.c:304
Call Trace:
 <TASK>
 dump_stack_lvl
 __might_resched.cold
 ath11k_wmi_cmd_send
 ath11k_wmi_set_peer_param
 ath11k_mac_disable_peer_fixed_rate
 ieee80211_iterate_stations_atomic
 ath11k_mac_op_set_bitrate_mask.cold

Change to ieee80211_iterate_stations_mtx() to fix this issue.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30

## Which versions are affected by CVE-2025-39732?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2025-39732?

Apply the vendor's patch.

## Is CVE-2025-39732 being exploited?

There is no known exploitation of CVE-2025-39732 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-39732 and fix it if it is affected.

What it is: CVE-2025-39732 is a high-severity denial of service vulnerability in Linux kernel, published on 7 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-39732 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-39732/ (Markdown: https://insights.sbomify.com/CVE-2025-39732/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-39732
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-39732
- OSV: https://osv.dev/vulnerability/CVE-2025-39732

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-39732/
Summaries are generated and may contain mistakes; the official description above is the record.