Thank you for your feedback,
After reevaluate, I found that this CVE-2025-38643 fixed warning occurs in wdev_chandef(net/wireless/chan.c:1552), which is not added in cfg80211_check_and_end_cac before kernel 6.12-rc1.
So, 5.4.y appears unaffected, despite introducing commit (26ec17a1dc5e). I'm withdrawing this backport.
Thanks,
lifangxu