wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release

{
  "id": "4ec8e9bc5c812c474ea45de439c452ad1cf2307dede423891613d530a4be3198",
  "url": "https://osv.dev/vulnerability/CVE-2025-37897",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release plfxlc_mac_release() asserts that mac->lock is held. This assertion is incorrect, because even if it was possible, it would not be the valid behaviour. The function is used when probe fails or after the device is disconnected. In both cases mac->lock can not be held as the driver is not working with the device at the moment. All functions that use mac->lock unlock it just after it was held. There is also no need to hold mac->lock for plfxlc_mac_release() itself, as mac data is not affected, except for mac->flags, which is modified atomically. This bug leads to the following warning: ================================================================ WARNING: CPU: 0 PID: 127 at drivers/net/wireless/purelifi/plfxlc/mac.c:106 plfxlc_mac_release+0x7d/0xa0 Modules linked in: CPU: 0 PID: 127 Comm: kworker/0:2 Not tainted 6.1.124-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event RIP: 0010:plfxlc_mac_release+0x7d/0xa0 drivers/net/wireless/purelifi/plfxlc/mac.c:106 Call Trace: probe+0x941/0xbd0 drivers/net/wireless/purelifi/plfxlc/usb.c:694 usb_probe_interface+0x5c0/0xaf0 drivers/usb/core/driver.c:396 really_probe+0x2ab/0xcb0 drivers/base/dd.c:639 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:785 driver_probe_device+0x50/0x420 drivers/base/dd.c:815 __device_attach_driver+0",
    "evidence": "osv:CVE-2025-37897",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.138",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.90",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.28",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.14.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2025-37897",
      "aliases": [
        "CVE-2025-37897"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "68d57a07bfe5bb29b80cd8b8fa24c9d1ea104124"
                },
                {
                  "fixed": "93d646911be1e5be20d4f5d6c48359464cef0097"
                },
                {
                  "fixed": "36a9a2647810e57e704dde59abdf831380ca9102"
                },
                {
                  "fixed": "791a2d9e87c411aec0b9b2fb735fd15e48af9de9"
                },
                {
                  "fixed": "9ecb4af39f80cdda3e57825923243ec11e48be6b"
                },
                {
                  "fixed": "0fb15ae3b0a9221be01715dac0335647c79f3362"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37897.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.19.0"
                },
                {
                  "fixed": "6.1.138"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.90"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.28"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.14.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37897.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.435564834Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/0fb15ae3b0a9221be01715dac0335647c79f3362",
        "https://git.kernel.org/stable/c/36a9a2647810e57e704dde59abdf831380ca9102",
        "https://git.kernel.org/stable/c/791a2d9e87c411aec0b9b2fb735fd15e48af9de9",
        "https://git.kernel.org/stable/c/93d646911be1e5be20d4f5d6c48359464cef0097",
        "https://git.kernel.org/stable/c/9ecb4af39f80cdda3e57825923243ec11e48be6b",
        "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37897.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-37897",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37897.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-37897",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 496964,
  "published_at": "2025-05-20T15:21:33.372+00:00"
}