Security readout for executives and security teams
Plain-English summary
A Linux Wi-Fi driver can continue sending commands while compatible Qualcomm ath12k firmware is recovering from a crash, producing a kernel call trace and potentially disrupting the system. Exposure is limited to systems using the affected ath12k path; the supplied evidence does not establish that every Linux system or Wi-Fi device is vulnerable.
Executive priority
Treat as a high-priority reliability and security update for confirmed ath12k deployments, especially business-critical wireless infrastructure. Do not apply the score indiscriminately across all Linux assets. First identify relevant hardware and driver use, then follow supported kernel update channels. Escalate systems showing firmware crashes or kernel traces.
Technical view
When ath12k receives a firmware-crash notification through MHI, recovery flags were not set soon enough. WMI commands could consequently reach unavailable firmware during recovery. The correction sets ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY at notification time, blocking those commands. Testing cited QCN9274 hw2.0 PCI hardware.
Likely exposure
Prioritize Linux hosts using ath12k with compatible Qualcomm wireless hardware, particularly QCN9274 deployments. The supplied affected-version data references Linux 6.13, 6.15.3, and 6.16 but is insufficiently structured to establish a reliable universal version range. Systems without ath12k or relevant hardware are unlikely to reach this code path.
Exploitation context
The source bundle marks this CVE high at CVSS 8.8 with adjacent-network reachability, but provides no demonstrated attack chain. It is not listed in KEV, and no supplied source reports active exploitation. The documented trigger is a firmware crash followed by driver recovery activity.
Researcher notes
The documented defect is a recovery-state race or sequencing failure, not evidence of code execution. The supplied CVSS claims high confidentiality, integrity, and availability impact, while the narrative primarily demonstrates a kernel call trace. Validate impact assumptions against vendor advisories. Exact affected and fixed version boundaries remain unclear from the provided version fields.
Mitigation direction
- Install a vendor kernel containing the referenced Linux stable correction or an equivalent backport.
- Prioritize ath12k systems using QCN9274 or other hardware confirmed affected by the Linux vendor.
- If updating is delayed, consult platform-vendor guidance for supported methods to disable or replace affected wireless hardware.
- Monitor kernel and wireless-driver logs for firmware crashes, recovery events, and associated call traces.
Validation and detection
- Inventory systems for the ath12k driver and identify the installed Qualcomm wireless hardware.
- Record kernel package, build, and distribution backport information; version numbers alone may be insufficient.
- Confirm vendor changelogs or source history include either referenced stable correction.
- After updating, verify normal wireless operation and absence of WMI-related call traces during recovery events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38291 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2563069baf243cadc76dc64d9085606742c4b282CVE reference, Linux
- https://git.kernel.org/stable/c/e9e094a9734ea3bd4d4d117c915ccf129ac61ba1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.