CVE-2025-38294

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL access in assign channel context handler Currently, when ath12k_mac_assign_vif_to_vdev() fails, the radio handle (ar) gets accessed from the link VIF handle (arvif) for debug logging, This is incorrect. In the fail scenario, radio handle is NULL. Fix the NULL access, avoid radio handle access by moving to the hardware debug logging helper function (ath12k_hw_warn). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/3f919f76893069ec3c7475acaeb611eb31fca22d	Patch
https://git.kernel.org/stable/c/ea24531d00f782f4e659e8c74578b7ac144720ca	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

History

19 Nov 2025, 20:42

Type	Values Removed	Values Added
CWE		CWE-476
First Time		Linux linux Kernel Linux
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CPE		cpe:2.3:o:linux:linux_kernel::::::::
References	~~() https://git.kernel.org/stable/c/3f919f76893069ec3c7475acaeb611eb31fca22d -~~	() https://git.kernel.org/stable/c/3f919f76893069ec3c7475acaeb611eb31fca22d - Patch
References	~~() https://git.kernel.org/stable/c/ea24531d00f782f4e659e8c74578b7ac144720ca -~~	() https://git.kernel.org/stable/c/ea24531d00f782f4e659e8c74578b7ac144720ca - Patch

Information

Published : 2025-07-10 08:15

Updated : 2025-11-19 20:42

NVD link : CVE-2025-38294

Mitre link : CVE-2025-38294

CVE.ORG link : CVE-2025-38294

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-38294", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-07-10T08:15:28.050", "references": [{"url": "https://git.kernel.org/stable/c/3f919f76893069ec3c7475acaeb611eb31fca22d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ea24531d00f782f4e659e8c74578b7ac144720ca", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix NULL access in assign channel context handler\n\nCurrently, when ath12k_mac_assign_vif_to_vdev() fails, the radio handle\n(ar) gets accessed from the link VIF handle (arvif) for debug logging, This\nis incorrect. In the fail scenario, radio handle is NULL. Fix the NULL\naccess, avoid radio handle access by moving to the hardware debug logging\nhelper function (ath12k_hw_warn).\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: correcci\u00f3n del acceso nulo en el controlador de contexto de asignaci\u00f3n de canal. Actualmente, cuando ath12k_mac_assign_vif_to_vdev() falla, se accede al controlador de radio (ar) desde el controlador VIF del enlace (arvif) para el registro de depuraci\u00f3n. Esto es incorrecto. En el escenario de fallo, el controlador de radio es nulo. Corrija el acceso nulo y evite el acceso al controlador de radio migrando a la funci\u00f3n auxiliar de registro de depuraci\u00f3n de hardware (ath12k_hw_warn). Probado en: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1. Probado en: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3."}], "lastModified": "2025-11-19T20:42:41.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59623E70-FBCF-4F5B-A3CE-07A4482CED29", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.14"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}