Security readout for executives and security teams
Plain-English summary
A Linux ath12k Wi-Fi debug interface accepts writes larger than its 32-byte buffer, causing kernel memory corruption. The source says access is limited to root users through debugfs, substantially reducing ordinary remote exposure. Successful abuse could affect confidentiality, integrity, and availability.
Executive priority
Prioritize patching on systems using ath12k where administrators, containers, or workloads can reach debugfs. Treat broad emergency action as unnecessary without confirmed exposure, but address affected shared or high-value systems promptly because kernel memory corruption has potentially severe impact.
Technical view
CVE-2025-38317 is a local buffer overflow in the Linux kernel ath12k debugfs write path. More than 32 bytes can corrupt kernel memory. The supplied assessment is CVSS 3.1 7.8, although its privileges-required value conflicts with the description’s root-only limitation. Three stable-kernel fix commits are referenced.
Likely exposure
Exposure requires a Linux system using the affected ath12k code, with debugfs available and an actor able to write to the vulnerable interface. The supplied version data identifies affected Linux releases but is ambiguous; confirm exact distribution kernel status with the vendor.
Exploitation context
The supplied sources provide no evidence of active exploitation, and this CVE is not listed as KEV in the bundle. The root-limited debugfs path makes it primarily a post-compromise, privileged-user, or unsafe-administration concern rather than a directly remote attack vector.
Researcher notes
The record describes an oversized debugfs write causing memory corruption and explicitly says access is limited to root. That conflicts with the supplied CVSS vector’s PR:L value. The affected-version list also contains unclear boundaries and a value of “0”; use vendor-specific advisories or commit ancestry for definitive assessment.
Mitigation direction
- Install a vendor-supported kernel update containing the referenced stable-kernel fix.
- Confirm distribution advisories because packaged kernel version mappings may differ from upstream releases.
- Restrict privileged access and avoid exposing debugfs where it is not operationally required.
- Monitor Linux vendor guidance for corrected affected-version information.
Validation and detection
- Inventory systems using Linux kernels and ath12k wireless hardware or drivers.
- Determine whether debugfs is mounted and the affected ath12k interface is present.
- Compare installed kernel packages against distribution security advisories and referenced fix commits.
- Verify the updated kernel is running after remediation, not merely installed.
- Review privileged-access logs for unexpected interaction with ath12k debugfs entries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38317 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0c57aa8ef94cffc5c2d68230e19329a03e71a94fCVE reference, Linux
- https://git.kernel.org/stable/c/8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3CVE reference, Linux
- https://git.kernel.org/stable/c/8c7a5031a6b0d42e640fbd2d5d05f61f74e32dceCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.