CVE-2025-38292: wifi: ath12k: fix invalid access to memory
Vulnerability summary
CVE-2025-38292 is a high (CVSS 8.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 23.7% of scored vulnerabilities.
Not severe (CVSS 8.8, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 41 · Related 39Timeline
- 10-07-2025PublishedVulnerability first disclosed.
- 21-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid access to memory In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean is_continuation is part of rxcb. Currently, after freeing the skb, the rxcb->is_continuation accessed again which is wrong since the memory is already freed. This might lead use-after-free error. Hence, fix by locally defining bool is_continuation from rxcb, so that after freeing skb, is_continuation can be used. Compile tested only.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 0.24% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu119 products
- linux< 6.8.0-100.100
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1046.49
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ d889913205cf7ebda905b1e62c5867ed4e39f6c2, < 920c2db46ca4476c25ec52758441e2e7ab498b0f | ≥ d889913205cf7ebda905b1e62c5867ed4e39f6c2, < 371b340affa52f280f6eadfd25fbd43f09f0d5c0 | ≥ d889913205cf7ebda905b1e62c5867ed4e39f6c2, < 5f09d16cd57764c95c8548fe5b70672c9ac01127 | ≥ d889913205cf7ebda905b1e62c5867ed4e39f6c2, < 9f17747fbda6fca934854463873c4abf8061491d | 6.3
- linux_kernel≥ 6.3, < 6.12.34 | ≥ 6.13, < 6.15.3
Debian1 product
- linux< 6.12.35-1
3 vendors · 122 products
