Security readout for executives and security teams
Plain-English summary
A Linux Wi-Fi driver flaw can crash the operating system during resume or recovery from Qualcomm ath11k firmware failures. The driver may treat destroyed ring data as initialized and read invalid kernel memory. Affected laptops, access points, or appliances could lose availability and require recovery or reboot.
Executive priority
Treat as a high-priority stability and availability issue for ath11k-equipped systems, especially operational appliances and frequently suspended endpoints. Patch through supported kernel channels after normal compatibility testing. Broader emergency action is not supported by the current exploitation evidence.
Technical view
ath11k_hal_srng_deinit() destroys SRNG lists without clearing each list's initialized flag. After failed ath11k crash reconfiguration, a later statistics dump trusts the stale flag and accesses deinitialized memory, causing a supervisor-mode page fault and kernel panic. The published fix clears the flag during deinitialization.
Likely exposure
Exposure is limited to Linux systems using the ath11k Wi-Fi driver and vulnerable kernel builds, particularly systems exercising suspend, resume, or firmware-crash recovery. The bundle lists several affected versions, but its version encoding is ambiguous; confirm fixed or backported status with the operating-system vendor.
Exploitation context
The supplied record marks this CVE as absent from KEV, and no cited source establishes active exploitation or a public exploit. Documented failures involve firmware crashes, repeated reset failures, resume, and subsequent statistics collection. The adjacent-network CVSS vector indicates potential remote proximity, but the sources do not demonstrate a reliable attacker-controlled trigger.
Researcher notes
The supplied CVSS is 8.8 with adjacent attack vector and high confidentiality, integrity, and availability impacts. However, the narrative directly demonstrates a stale-state memory access and kernel panic, not proven data disclosure, modification, or attacker control. Reproduction and exploitability evidence are incomplete, so impact claims should remain conservative.
Mitigation direction
- Install a vendor-supported kernel containing the linked ath11k fix or an equivalent backport.
- Check distribution security guidance to identify the corrected package for each deployed kernel branch.
- Prioritize systems using ath11k that suspend frequently or have recorded Wi-Fi firmware recovery failures.
- Use vendor-recommended operational workarounds if immediate kernel replacement is unavailable.
Validation and detection
- Inventory Linux systems using the ath11k driver and record their exact kernel package versions.
- Confirm the installed kernel includes the stable fix or a distribution-maintained equivalent backport.
- Review kernel logs for ath11k recovery failures, page faults, or ath11k_hal_dump_srng_stats panics.
- After remediation, validate suspend, resume, and normal Wi-Fi recovery under controlled conditions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38601 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3a6daae987a829534636fd85ed6f84d5f0ad7fa4CVE reference, Linux
- https://git.kernel.org/stable/c/eff3bb53c18c0ed4ab6f43d412b3ed3aecad52d5CVE reference, Linux
- https://git.kernel.org/stable/c/916ac18d526a26f6072866b1a97622cf1351ef1cCVE reference, Linux
- https://git.kernel.org/stable/c/5bf201c55fdf303e79005038648dfa1e8af48f54CVE reference, Linux
- https://git.kernel.org/stable/c/72a48be1f53942793f3bc68a37fad1f38b53b082CVE reference, Linux
- https://git.kernel.org/stable/c/0ebb5fe494501c19f31270008b26ab95201af6fdCVE reference, Linux
- https://git.kernel.org/stable/c/16872194c80f2724472fc207991712895ac8a230CVE reference, Linux
- https://git.kernel.org/stable/c/a5b46aa7cf5f05c213316a018e49a8e086efd98eCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.