Thank you for your feedback,

After reevaluate, I found that this CVE-2025-38643 fixed warning occurs in
wdev_chandef(net/wireless/chan.c:1552), which is not added in
cfg80211_check_and_end_cac before kernel 6.12-rc1. 

So, 5.4.y appears unaffected, despite introducing commit (26ec17a1dc5e).
I'm withdrawing this backport.

Thanks,

lifangxu