CVE-2025-39732: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39732 is a vulnerability discovered in the Linux kernel affecting the WiFi subsystem, specifically the ath11k driver. The vulnerability was disclosed and published to the CVE List on September 7, 2025. It involves a sleeping-in-atomic issue in the ath11kmacopsetbitratemask function, where the ath11kmacdisablepeerfixedrate function is incorrectly used as an iterator in ieee80211iteratestations_atomic (NVD CVE).

The vulnerability occurs when ath11kmacdisablepeerfixedrate() is passed as the iterator to ieee80211iteratestationsatomic(). While the iterator is required to be atomic, ath11kmacdisablepeerfixedrate() does not comply with this requirement as it might sleep, leading to a BUG warning at wmi.c:304. The issue affects the WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPLV1V2SILICONZ_LITE-3.6510.30 hardware (NVD CVE).

The vulnerability can cause system instability due to improper handling of atomic contexts in the Linux kernel's WiFi subsystem. This could potentially lead to system crashes or unpredictable behavior when setting bitrate masks for WiFi connections (NVD CVE).

The issue has been resolved by changing the implementation to use ieee80211iteratestationsmtx() instead of ieee80211iteratestationsatomic(). This fix ensures proper handling of the sleeping function in the appropriate context (NVD CVE).