CVE-2025-38013

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38013
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller: UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') This was missed in the initial conversions because I failed to locate the allocation likely due to the "sizeof(void *)" not matching the "channels" array type.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/07c737d9ab02c07b562aefcca16aa95077368e24 Patch
https://git.kernel.org/stable/c/82bbe02b2500ef0a62053fe2eb84773fe31c5a0a Patch
https://git.kernel.org/stable/c/e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81 Patch
https://git.kernel.org/stable/c/fde33ab3c052a302ee8a0b739094b88ceae4dd67 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
History

17 Nov 2025, 12:55

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/07c737d9ab02c07b562aefcca16aa95077368e24 - () https://git.kernel.org/stable/c/07c737d9ab02c07b562aefcca16aa95077368e24 - Patch
References () https://git.kernel.org/stable/c/82bbe02b2500ef0a62053fe2eb84773fe31c5a0a - () https://git.kernel.org/stable/c/82bbe02b2500ef0a62053fe2eb84773fe31c5a0a - Patch
References () https://git.kernel.org/stable/c/e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81 - () https://git.kernel.org/stable/c/e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81 - Patch
References () https://git.kernel.org/stable/c/fde33ab3c052a302ee8a0b739094b88ceae4dd67 - () https://git.kernel.org/stable/c/fde33ab3c052a302ee8a0b739094b88ceae4dd67 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
CWE CWE-129
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: Establecer n_channels tras asignar la estructura cfg80211_scan_request. Asegúrese de que n_channels esté establecido tras asignar el miembro de la estructura cfg80211_registered_device::int_scan_req. Observada con syzkaller: UBSAN: array-index-out-of-bounds en net/mac80211/scan.c:1208:5. El índice 0 está fuera de rango para el tipo 'struct ieee80211_channel *[] __counted_by(n_channels)' (también conocido como 'struct ieee80211_channel *[]'). Esto no se detectó en las conversiones iniciales porque no se localizó la asignación, probablemente debido a que "sizeof(void *)" no coincide con el tipo de matriz "channels".

18 Jun 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 10:15

Updated : 2025-11-17 12:55

NVD link : CVE-2025-38013

Mitre link : CVE-2025-38013

CVE.ORG link : CVE-2025-38013

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-129

Improper Validation of Array Index