CVE-2025-38292

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38292
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid access to memory In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean is_continuation is part of rxcb. Currently, after freeing the skb, the rxcb->is_continuation accessed again which is wrong since the memory is already freed. This might lead use-after-free error. Hence, fix by locally defining bool is_continuation from rxcb, so that after freeing skb, is_continuation can be used. Compile tested only.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/371b340affa52f280f6eadfd25fbd43f09f0d5c0 Patch
https://git.kernel.org/stable/c/5f09d16cd57764c95c8548fe5b70672c9ac01127 Patch
https://git.kernel.org/stable/c/9f17747fbda6fca934854463873c4abf8061491d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

19 Nov 2025, 20:42

Type Values Removed Values Added
CWE CWE-125
References () https://git.kernel.org/stable/c/371b340affa52f280f6eadfd25fbd43f09f0d5c0 - () https://git.kernel.org/stable/c/371b340affa52f280f6eadfd25fbd43f09f0d5c0 - Patch
References () https://git.kernel.org/stable/c/5f09d16cd57764c95c8548fe5b70672c9ac01127 - () https://git.kernel.org/stable/c/5f09d16cd57764c95c8548fe5b70672c9ac01127 - Patch
References () https://git.kernel.org/stable/c/9f17747fbda6fca934854463873c4abf8061491d - () https://git.kernel.org/stable/c/9f17747fbda6fca934854463873c4abf8061491d - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

10 Jul 2025, 13:17

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: se corrige el acceso no válido a la memoria. En ath12k_dp_rx_msdu_coalesce(), rxcb se obtiene de skb y el booleano is_continuation forma parte de rxcb. Actualmente, tras liberar skb, se accede de nuevo a rxcb->is_continuation, lo cual es incorrecto, ya que la memoria ya está liberada. Esto podría provocar un error de uso tras liberación. Por lo tanto, se debe corregir definiendo localmente el booleano is_continuation desde rxcb, de modo que, tras liberar skb, se pueda usar is_continuation. Solo se ha probado la compilación.

10 Jul 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-10 08:15

Updated : 2025-11-19 20:42

NVD link : CVE-2025-38292

Mitre link : CVE-2025-38292

CVE.ORG link : CVE-2025-38292

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read