CVE-2025-38116
BaseFortify
Publication date: 2025-07-03
Last updated on: 2025-11-20
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free (UAF) issue in the Linux kernel's ath12k WiFi driver. When certain functions (ath12k_core_hw_group_assign() or ath12k_core_hw_group_create()) fail during initialization, the notifier chain that was registered is not properly unregistered. As a result, after the module is removed (rmmod), the memory for this notifier chain is freed but may still be accessed later, leading to a use-after-free condition.
How can this vulnerability impact me? :
The use-after-free vulnerability can lead to undefined behavior such as system crashes, memory corruption, or potentially allow an attacker to execute arbitrary code with kernel privileges if they can trigger the faulty access. This can compromise system stability and security.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the use-after-free issue in the ath12k driver. The fix involves proper unregistration of the notifier chain by calling ath12k_core_panic_notifier_unregister() in failure cases. Avoid using vulnerable kernel versions and apply vendor or distribution patches as soon as they are available.