CVE-2025-38317
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-11-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a buffer overflow in the Linux kernel's ath12k wifi driver debugfs interface. Specifically, if a user writes more than 32 bytes to this debugfs entry, it causes memory corruption. However, since debugfs access is limited to root users, the risk is restricted to those with root privileges.
How can this vulnerability impact me? :
The vulnerability can lead to memory corruption if exploited by a root user writing more than 32 bytes to the debugfs interface of the ath12k wifi driver. This could potentially cause system instability or allow for further exploitation by an attacker with root access.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the buffer overflow in the ath12k debugfs interface is fixed. Since the vulnerability is limited to root users writing more than 32 bytes to debugfs, restricting root access and avoiding writing large inputs to the debugfs ath12k interface can reduce risk until the patch is applied.