Security readout for executives and security teams
Plain-English summary
A Linux Wi-Fi driver may read memory after it has been freed while processing received data. The supplied CVSS score is 8.8, indicating potentially severe confidentiality, integrity, and availability impact. Exposure is limited to systems using the affected ath12k driver and vulnerable kernel code.
Executive priority
Treat this as a high-priority kernel maintenance issue for ath12k-equipped devices. Accelerate inventory and vendor-supported updates where wireless proximity is plausible. Emergency incident handling is not justified by the supplied evidence alone because active exploitation and demonstrated real-world impact are not documented.
Technical view
ath12k_dp_rx_msdu_coalesce() retrieves rxcb from an skb, frees that skb, then accesses rxcb->is_continuation. The stable fix copies the Boolean value before freeing the skb, preventing the possible use-after-free. The source states the change was compile-tested only.
Likely exposure
Prioritize Linux devices using the ath12k wireless driver, particularly those within adjacent wireless reach. The bundle lists versions including 6.3, 6.12.34, 6.15.3, and 6.16, but its flattened version data does not establish reliable affected or fixed ranges. Confirm status with the kernel distributor.
Exploitation context
The CVSS vector describes an adjacent-network, low-complexity condition requiring no privileges or user interaction. However, the bundle provides no evidence of public exploitation or a working exploit, and the CVE is not listed as KEV. The description says the flaw might cause a use-after-free; it does not document demonstrated impact.
Researcher notes
The defect is a narrowly described lifetime error involving skb-derived rxcb state. Three stable-kernel commits are cited as fixes. Exact vulnerable version boundaries are unclear in the supplied normalized data, and no CWE is assigned. Assess backports by commit inclusion rather than version-number assumptions.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable cited stable fix.
- Check Linux distributor guidance for precise affected and corrected package versions.
- Prioritize ath12k-enabled systems reachable through untrusted or shared wireless environments.
- Test the update carefully because the submitted fix was compile-tested only.
Validation and detection
- Inventory systems that load or depend upon the ath12k wireless driver.
- Map installed kernel packages against distributor advisories and supported release metadata.
- Confirm the deployed kernel incorporates the applicable cited stable commit.
- After updating, test ath12k connectivity and monitor for kernel memory errors or crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38292 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/371b340affa52f280f6eadfd25fbd43f09f0d5c0CVE reference, Linux
- https://git.kernel.org/stable/c/5f09d16cd57764c95c8548fe5b70672c9ac01127CVE reference, Linux
- https://git.kernel.org/stable/c/9f17747fbda6fca934854463873c4abf8061491dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.