Security readout for executives and security teams
Plain-English summary
A flaw in the Linux rtw89 Wi-Fi driver could cause an out-of-bounds memory access when an excessive link identifier is written through debugfs. Although the supplied CVSS score is 7.3, writing the relevant debugfs file requires root access, substantially limiting practical exposure.
Executive priority
Prioritize routine kernel remediation on affected wireless Linux systems, especially multi-user, developer, or appliance environments where privileged access is broader. Emergency action is not supported by the supplied evidence because exploitation requires root and no active exploitation is reported. Still, patch promptly because memory corruption could amplify damage after privileged compromise.
Technical view
In rtw89_core_mlsr_switch(), a user-supplied debugfs link_id could exceed BITS_PER_LONG, causing shift wrapping and a later potential out-of-bounds access. The resolved implementation limits link_id to IEEE80211_MLD_MAX_NUM_LINKS, which is 15. The source describes possible confidentiality, integrity, and availability impact.
Likely exposure
Exposure requires an affected Linux kernel using the rtw89 Wi-Fi driver, accessible debugfs, and an actor able to write the relevant file as root. Systems without rtw89, without debugfs access, or without compromised privileged access are unlikely to be directly exposed. The supplied version data is insufficiently clear for precise distribution-specific conclusions.
Exploitation context
The source bundle does not report active exploitation, and the CVE is not listed as KEV. Exploitation requires local privileged interaction with debugfs rather than unauthenticated remote access. Root-only write access makes this more relevant as a defense-in-depth issue after privilege compromise than as an initial intrusion path.
Researcher notes
The key boundary error is an unchecked link_id used in a bit shift before later indexing. The correction caps it at the protocol-defined maximum of 15. The supplied version representation is ambiguous, so researchers should use the referenced commits and distribution backport records instead of relying solely on displayed version strings. No CWE was supplied.
Mitigation direction
- Install a vendor kernel update containing the referenced upstream stable fix.
- Consult the Linux distribution's advisory to confirm its fixed package version.
- Restrict root access and investigate unauthorized privileged account activity.
- Disable or restrict debugfs where operationally feasible and consistent with vendor guidance.
Validation and detection
- Record kernel and distribution package versions on systems using rtw89 Wi-Fi hardware.
- Confirm whether the rtw89 driver is loaded or otherwise used.
- Verify the installed kernel includes one of the referenced stable fixes or a vendor backport.
- Review debugfs availability and permissions for the affected interface.
- Check privileged-access logs for unexpected debugfs activity where telemetry exists.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38657 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/417cfa9cc44fbe6bceab786f9a4ee5a210f1288eCVE reference, Linux
- https://git.kernel.org/stable/c/53cf488927a0f79968f9c03c4d1e00d2a79731c3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.