LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38116: wifi: ath12k: fix uaf in ath12k_core_init()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix uaf in ath12k_core_init() When the execution of ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() fails, the registered notifier chain is not unregistered properly. Its memory is freed after rmmod, which may trigger to a use-after-free (UAF) issue if there is a subsequent access to this notifier chain. Fixes the issue by calling ath12k_core_panic_notifier_unregister() in failure cases. Call trace: notifier_chain_register+0x4c/0x1f0 (P) atomic_notifier_chain_register+0x38/0x68 ath12k_core_init+0x50/0x4e8 [ath12k] ath12k_pci_probe+0x5f8/0xc28 [ath12k] pci_device_probe+0xbc/0x1a8 really_probe+0xc8/0x3a0 __driver_probe_device+0x84/0x1b0 driver_probe_device+0x44/0x130 __driver_attach+0xcc/0x208 bus_for_each_dev+0x84/0x100 driver_attach+0x2c/0x40 bus_add_driver+0x130/0x260 driver_register+0x70/0x138 __pci_register_driver+0x68/0x80 ath12k_pci_init+0x30/0x68 [ath12k] ath12k_init+0x28/0x78 [ath12k] Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux Wi-Fi driver error can leave a notifier referencing freed memory when ath12k initialization fails and the module is removed. Later access may corrupt memory, crash the system, or potentially affect confidentiality and integrity. The supplied CVSS score is 7.8 (high), but the evidence does not establish active exploitation.

Executive priority

Treat as a high-priority kernel maintenance issue for endpoints or appliances using ath12k Wi-Fi. Accelerate patching where driver initialization failures have occurred. Systems without ath12k exposure are lower priority, and there is no supplied evidence of active exploitation.

Technical view

CVE-2025-38116 is a use-after-free in ath12k_core_init(). Failure in ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() leaves the panic notifier registered. After module removal frees its memory, subsequent notifier access may use that freed memory. The kernel fix unregisters the notifier on these failure paths.

Likely exposure

Exposure is limited to Linux systems using the affected ath12k Wi-Fi driver where hardware-group assignment or creation fails, followed by module removal and later notifier access. The supplied version data is insufficiently clear for precise distribution-specific mapping, so installed kernels should be checked against vendor advisories and the referenced fixes.

Exploitation context

The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. The bundle marks this CVE as absent from KEV and provides no evidence of exploitation in the wild.

Researcher notes

The failure-path cleanup omits ath12k_core_panic_notifier_unregister(), leaving a stale notifier after associated memory is freed during module removal. Triggerability depends on initialization failure, module lifecycle, and later notifier access. The supplied affected-version representation is ambiguous; use the stable commits and distribution package metadata for authoritative build-level assessment.

Mitigation direction

  • Update to a vendor-supported kernel containing the referenced ath12k notifier-unregistration fix.
  • Check Linux distribution advisories for the exact fixed package and reboot requirements.
  • Prioritize systems that load ath12k and have experienced driver initialization failures.
  • If updating is delayed, consult vendor guidance for supported temporary mitigations.

Validation and detection

  • Record the running kernel and distribution package version on potentially exposed systems.
  • Confirm whether the ath12k driver is present or loaded on each system.
  • Review kernel logs for ath12k initialization or hardware-group creation failures.
  • Verify the installed kernel includes an applicable referenced stable fix.
  • After updating, confirm the fixed kernel is running following any required reboot.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38116 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38116Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6f245ea0ec6c29b90c8fa4fdf6e178c646125d7e, 6f245ea0ec6c29b90c8fa4fdf6e178c646125d7eunaffected
LinuxLinux6.14, 0, 6.15.3, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.