Security readout for executives and security teams
Plain-English summary
A flaw in the Linux ath11k Wi-Fi driver can corrupt an internal interface list when wireless recovery overlaps interface removal. The resulting consistency check can panic the kernel, abruptly disrupting the affected device or service. The supplied evidence demonstrates a crash condition, but does not establish practical confidentiality or integrity impact despite the 8.8 CVSS score.
Executive priority
Treat this as a high-priority availability issue for ath11k-equipped Linux endpoints, appliances, and operational systems. Patch promptly where crashes would interrupt critical service. Broader emergency action is not supported because the bundle provides no evidence of active exploitation and does not establish impact beyond kernel panic.
Technical view
During ath11k WLAN recovery, ath11k_core_halt() reinitializes only the ar->arvifs list head, leaving adjacent nodes inconsistent. If interface removal reaches list_del() after this recovery state is created, kernel list validation can trigger a panic. The upstream fix removes and reinitializes every virtual-interface node during halt.
Likely exposure
Exposure is limited to Linux systems using the ath11k driver and vulnerable kernel code, with the triggering race requiring WLAN recovery during virtual-interface removal. The source lists several affected kernel versions, but its version formatting is ambiguous. The reported test platform was QCA6698AQ hw2.1; applicability to other ath11k hardware is not established here.
Exploitation context
The supplied record does not report active exploitation, and it is not marked as CISA KEV. No public exploit evidence is included. Triggering requires an adjacent WLAN condition and a specific timing overlap, so real-world exploitability cannot be determined from this bundle alone.
Researcher notes
The documented root cause is stale bidirectional-list linkage following partial list reinitialization. The failure is a race between WLAN recovery and ath11k_mac_op_remove_interface(). Stable-kernel commits are supplied for multiple branches. Researchers should avoid generalizing beyond ath11k or the tested QCA6698AQ platform without additional evidence.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream ath11k correction.
- Review Linux distribution advisories to identify the corrected package for each deployed kernel.
- Prioritize Wi-Fi-dependent systems where an unexpected kernel panic would materially disrupt operations.
- If immediate patching is unavailable, consult vendor guidance for supported temporary mitigations.
Validation and detection
- Inventory systems loading ath11k and identify their exact kernel builds and wireless hardware.
- Compare deployed kernel packages with vendor advisories and the referenced stable-kernel fixes.
- Review kernel logs for ath11k recovery, list corruption, or the documented remove-interface panic trace.
- After updating, confirm the running kernel package includes the applicable backported correction.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38293 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6c139015b597e570dd5962934e9f9a2f4cc8ef48CVE reference, Linux
- https://git.kernel.org/stable/c/f9507cf2dd0e1ed5028c0e8240da6fe5fd3110d3CVE reference, Linux
- https://git.kernel.org/stable/c/b0974ed82e6ad5ff246fd90a5b14f3e7be4f2924CVE reference, Linux
- https://git.kernel.org/stable/c/f50ba7e7b607f2d00618799312e7fdb76a1ff48eCVE reference, Linux
- https://git.kernel.org/stable/c/f5d77d0d41ea7a204d47288d0cf0404a52b5890eCVE reference, Linux
- https://git.kernel.org/stable/c/6d6cb27fe146061f2512e904618f5e005bb7bb6aCVE reference, Linux
- https://git.kernel.org/stable/c/31e98e277ae47f56632e4d663b1d4fd12ba33ea8CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.