CVE-2025-38157: wifi: ath9k_htc: Abort software beacon handling if disabled
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9khtc: Abort software beacon handling if disabled
A malicious USB device can send a WMISWBAEVENTID event from an ath9khtc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds read.
Prevent this by aborting the handling in ath9khtcswba() if beacons are not enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38157?
CVE-2025-38157 has a moderate severity level due to its potential impact on devices using the ath9k_htc driver.
How do I fix CVE-2025-38157?
To fix CVE-2025-38157, update the Linux kernel to the latest version where this vulnerability is patched.
What type of vulnerability is CVE-2025-38157?
CVE-2025-38157 is a Denial of Service vulnerability associated with the ath9k_htc driver in the Linux kernel.
Which systems are affected by CVE-2025-38157?
CVE-2025-38157 affects Linux systems that utilize the ath9k_htc wireless driver.
What are the consequences of exploiting CVE-2025-38157?
Exploiting CVE-2025-38157 can lead to a denial of service condition, causing affected devices to become unresponsive.