CVE-2025-38292

wifi: ath12k: fix invalid access to memory

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid access to memory In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean is_continuation is part of rxcb. Currently, after freeing the skb, the rxcb->is_continuation accessed again which is wrong since the memory is already freed. This might lead use-after-free error. Hence, fix by locally defining bool is_continuation from rxcb, so that after freeing skb, is_continuation can be used. Compile tested only.

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/371b340affa52f280f6eadfd25fbd43f09f0d5c0
https://git.kernel.org/stable/c/5f09d16cd57764c95c8548fe5b70672c9ac01127
https://git.kernel.org/stable/c/9f17747fbda6fca934854463873c4abf8061491d

Frequently Asked Questions

What is the severity of CVE-2025-38292?: CVE-2025-38292 has not yet been assigned a CVSS score.
How to fix CVE-2025-38292?: To fix CVE-2025-38292, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-38292 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-38292 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-38292?: CVE-2025-38292 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.