CVE-2025-38157
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software beacon handling if disabled A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds read. Prevent this by aborting the handling in ath9k_htc_swba() if beacons are not enabled.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-07-03 09:15:30.757000
Last modified
2026-11-05 21:18:11.883000
View original CVE JSON
{
"id": "CVE-2025-38157",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-07-03T09:15:30.757",
"lastModified": "2026-11-05T21:18:11.883",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: Abort software beacon handling if disabled\n\nA malicious USB device can send a WMI_SWBA_EVENTID event from an\nath9k_htc-managed device before beaconing has been enabled. This causes\na device-by-zero error in the driver, leading to either a crash or an\nout of bounds read.\n\nPrevent this by aborting the handling in ath9k_htc_swba() if beacons are\nnot enabled."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath9k_htc: Cancelar la gestión de balizas de software si está deshabilitada. Un dispositivo USB malicioso puede enviar un evento WMI_SWBA_EVENTID desde un dispositivo administrado por ath9k_htc antes de que se haya habilitado la baliza. Esto provoca un error de dispositivo por cero en el controlador, lo que provoca un bloqueo o una lectura fuera de los límites. Para evitarlo, cancele la gestión en ath9k_htc_swba() si las balizas no están habilitadas."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/wireless/ath/ath9k/htc_drv_beacon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "832f6a18fc2aead14954c081ece03b7a5b425f81",
"lessThan": "e5ce9df1d68094d37360dbd9b09289d42fa21e54",
"versionType": "git",
"status": "affected"
},
{
"version": "832f6a18fc2aead14954c081ece03b7a5b425f81",
"lessThan": "0281c19074976ec48f0078d50530b406ddae75bc",
"versionType": "git",
"status": "affected"
},
{
"version": "832f6a18fc2aead14954c081ece03b7a5b425f81",
"lessThan": "7ee3fb6258da8c890a51b514f60d7570dc703605",
"versionType": "git",
"status": "affected"
},
{
"version": "832f6a18fc2aead14954c081ece03b7a5b425f81",
"lessThan": "40471b23147c86ea3ed97faee79937c618250bd0",
"versionType": "git",
"status": "affected"
},
{
"version": "832f6a18fc2aead14954c081ece03b7a5b425f81",
"lessThan": "5482ef9875eaa43f0435e14570e1193823de857e",
"versionType": "git",
"status": "affected"
},
{
"version": "832f6a18fc2aead14954c081ece03b7a5b425f81",
"lessThan": "ee5ee646385f5846dcbc881389f3c44a197c402a",
"versionType": "git",
"status": "affected"
},
{
"version": "832f6a18fc2aead14954c081ece03b7a5b425f81",
"lessThan": "5a85c21f812e02cb00ca07007d88acdd42d08c46",
"versionType": "git",
"status": "affected"
},
{
"version": "832f6a18fc2aead14954c081ece03b7a5b425f81",
"lessThan": "ac4e317a95a1092b5da5b9918b7118759342641c",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/wireless/ath/ath9k/htc_drv_beacon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.0",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.0",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.295",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.239",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.186",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.142",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.94",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.34",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.15.3",
"lessThanOrEqual": "6.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-05T20:50:39.376800Z",
"id": "CVE-2025-38157",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0",
"versionEndExcluding": "5.4.295",
"matchCriteriaId": "34030265-A375-433C-9142-5BD3EFE492A1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "5.10.239",
"matchCriteriaId": "C3D14F4C-A21E-465D-A928-5CCE684E2B98"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.186",
"matchCriteriaId": "D96F2C0D-0D4A-4658-AD34-D8A626EA422D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.142",
"matchCriteriaId": "459B4E94-FE0E-434D-B782-95E3A5FFC6B1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.94",
"matchCriteriaId": "304E3F01-7D7A-4908-994E-7F95C5C00B06"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.34",
"matchCriteriaId": "4FFA54AA-CDFE-4591-BD07-72813D0948F4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.3",
"matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/0281c19074976ec48f0078d50530b406ddae75bc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/40471b23147c86ea3ed97faee79937c618250bd0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5482ef9875eaa43f0435e14570e1193823de857e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5a85c21f812e02cb00ca07007d88acdd42d08c46",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7ee3fb6258da8c890a51b514f60d7570dc703605",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ac4e317a95a1092b5da5b9918b7118759342641c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e5ce9df1d68094d37360dbd9b09289d42fa21e54",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ee5ee646385f5846dcbc881389f3c44a197c402a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
}
]
}