Security readout for executives and security teams
Plain-English summary
This is a Linux kernel iwlwifi driver bug where a failed workqueue allocation was not checked. On affected systems using Intel Wi-Fi support, an uncommon allocation failure could cause unreliable behavior or a crash. The sources do not provide a CVSS score, CWE, or evidence of active exploitation.
Executive priority
Treat this as routine kernel maintenance unless your fleet heavily depends on Linux endpoints with Intel Wi-Fi. There is no source-backed active exploitation signal, but kernel driver crashes can still affect availability and support costs.
Technical view
The fix adds a missing NULL check after alloc_ordered_workqueue in the iwlwifi driver. Without the check, later code could dereference a NULL pointer if allocation fails. Public records list Linux kernel impact and stable kernel commits, but do not describe exploitability, required privileges, or attacker control.
Likely exposure
Exposure is likely limited to Linux systems running affected kernels with the iwlwifi Intel wireless driver present or enabled. Servers without Intel Wi-Fi hardware are less likely to be exposed, but kernel package inventories should be checked against distro advisories.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of exploitation in the wild. The available description suggests a reliability or denial-of-service class issue tied to allocation failure, but exploit preconditions are not documented.
Researcher notes
Evidence is sparse: no CVSS, CWE, detailed impact statement, or exploit prerequisites are provided. The key technical fact is the missing NULL check for alloc_ordered_workqueue in iwlwifi, resolved through multiple Linux stable commits.
Mitigation direction
- Update affected Linux kernels using vendor or distro security packages.
- Track the referenced Linux stable commits for kernel builds maintained internally.
- Review Debian LTS advisories if using affected Debian LTS kernels.
- Prioritize laptops, workstations, and edge devices with Intel Wi-Fi hardware.
- Check vendor guidance before applying nonstandard driver workarounds.
Validation and detection
- Inventory Linux kernel versions across endpoints and servers.
- Identify systems loading or packaging the iwlwifi driver.
- Map installed distro kernel packages to vendor security advisories.
- Confirm updated kernels include the referenced stable fixes.
- Document systems without Intel Wi-Fi as lower-likelihood exposure.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit c80832d445653baba5ac80cd2c2637c437ac881b
- Linux stable commit b398120fbe0acfef60b16f6a0f69902d385d7728
- Linux stable commit 2e9f85ee3b46453a2f250a57d3a9f10c70c71202
- Linux stable commit 6663c52608d8d8727bf1911e6d9218069ba1c85e
- Linux stable commit ca980f1911a7144d451d1c31298ab8507c6bd88f
- Linux stable commit 7dd6350307af6521b6240b295c93b7eec4daebe6
- Linux stable commit c0e43c3f6c0a79381b468574c241065998412b7c
- Linux stable commit 70a1b527eaea9430b1bd87de59f3b9f6bd225701
- Linux stable commit 90a0d9f339960448a3acc1437a46730f975efd6a
- Debian LTS announcement
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38602 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c80832d445653baba5ac80cd2c2637c437ac881bCVE reference, Linux
- https://git.kernel.org/stable/c/b398120fbe0acfef60b16f6a0f69902d385d7728CVE reference, Linux
- https://git.kernel.org/stable/c/2e9f85ee3b46453a2f250a57d3a9f10c70c71202CVE reference, Linux
- https://git.kernel.org/stable/c/6663c52608d8d8727bf1911e6d9218069ba1c85eCVE reference, Linux
- https://git.kernel.org/stable/c/ca980f1911a7144d451d1c31298ab8507c6bd88fCVE reference, Linux
- https://git.kernel.org/stable/c/7dd6350307af6521b6240b295c93b7eec4daebe6CVE reference, Linux
- https://git.kernel.org/stable/c/c0e43c3f6c0a79381b468574c241065998412b7cCVE reference, Linux
- https://git.kernel.org/stable/c/70a1b527eaea9430b1bd87de59f3b9f6bd225701CVE reference, Linux
- https://git.kernel.org/stable/c/90a0d9f339960448a3acc1437a46730f975efd6aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.