{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-38292",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T04:51:24.001Z",
        "datePublished": "2025-07-10T07:42:07.506Z",
        "dateUpdated": "2026-08-05T12:01:02.320Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:01:02.320Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix invalid access to memory\n\nIn ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean\nis_continuation is part of rxcb.\nCurrently, after freeing the skb, the rxcb->is_continuation accessed\nagain which is wrong since the memory is already freed.\nThis might lead use-after-free error.\n\nHence, fix by locally defining bool is_continuation from rxcb,\nso that after freeing skb, is_continuation can be used.\n\nCompile tested only."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:A - The vulnerable code is the ath12k Wi-Fi 7 receive data path, reached only by processing 802.11 frames delivered by the radio, so the attacker must be within radio range on the same wireless segment. Per kernel guidance, WiFi frame reception/injection is Adjacent.\nAC:L - Reaching `ath12k_dp_rx_msdu_coalesce()` needs only an MSDU larger than a single 2048-byte RX buffer (an ordinary A-MSDU or jumbo frame), and the read of the freed `skb->cb` then occurs deterministically on every such frame — no condition outside the attacker's control.\nPR:N - The attacker needs no account or privilege on the target; it only transmits frames. This applies to an ath12k device in AP/mesh mode on an open network (hotspots, IoT/embedded/automotive deployments) or to a STA associated with an attacker-controlled AP.\nUI:N - Frames are consumed automatically by the NAPI softirq RX path with no action by any local user or operator.\nS:U - The freed-memory access and its consequences are entirely within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of a recycled `skbuff_head_cache` object, and the resulting `msdu_list` desynchronization causes continuation-buffer payload to be parsed as a `hal_rx_desc` and copied into frames delivered up the stack, exposing adjacent memory contents.\nI:H - Loop control flow is driven by the freed byte; the resulting desync feeds attacker-controlled `msdu_len`/`l3_pad_bytes` into `skb_put()` and `skb_copy_from_linear_data()`, and the UAF itself gives heap-grooming leverage over the freed slab object, which is treated as High.\nA:H - The corrupted buffer accounting reaches `skb_over_panic()`/BUG and leaks RX skbs, and the use-after-free itself trips KASAN/slab checks — any kernel crash or oops is High."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wireless/ath/ath12k/dp_rx.c"
                    ],
                    "versions": [
                        {
                            "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
                            "lessThan": "371b340affa52f280f6eadfd25fbd43f09f0d5c0",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
                            "lessThan": "5f09d16cd57764c95c8548fe5b70672c9ac01127",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
                            "lessThan": "9f17747fbda6fca934854463873c4abf8061491d",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wireless/ath/ath12k/dp_rx.c"
                    ],
                    "versions": [
                        {
                            "version": "6.3",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.3",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.34",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.15.3",
                            "lessThanOrEqual": "6.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.16",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.3",
                                    "versionEndExcluding": "6.12.34"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.3",
                                    "versionEndExcluding": "6.15.3"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.3",
                                    "versionEndExcluding": "6.16"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/371b340affa52f280f6eadfd25fbd43f09f0d5c0"
                },
                {
                    "url": "https://git.kernel.org/stable/c/5f09d16cd57764c95c8548fe5b70672c9ac01127"
                },
                {
                    "url": "https://git.kernel.org/stable/c/9f17747fbda6fca934854463873c4abf8061491d"
                }
            ],
            "title": "wifi: ath12k: fix invalid access to memory",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}