CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrol(rtwdev, para[0], ¶[1])', which reads 5 bytes:
void rtwfwbtwificontrol(struct rtwdev rtwdev, u8 opcode, u8 data) { ... SETBTWIFICONTROLDATA1(h2cpkt, data); SETBTWIFICONTROLDATA2(h2cpkt, (data + 1)); ... SETBTWIFICONTROLDATA5(h2cpkt, (data + 4));
Detected using the static analysis tool - Svace.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Set the 'para' buffer size to 6 instead of 2 to prevent out-of-bounds reads by rtw_fw_bt_wifi_control.
Linux kernel wifi: rtw88 para buffer size = 6
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38159?
CVE-2025-38159 is considered to have moderate severity due to the potential for reading out of bounds in the Linux kernel.
How do I fix CVE-2025-38159?
To mitigate CVE-2025-38159, update the Linux kernel to the latest patched version that addresses this vulnerability.
What components are affected by CVE-2025-38159?
CVE-2025-38159 specifically affects the wifi driver component of the Linux kernel.
What is the impact of CVE-2025-38159 exploitation?
Exploitation of CVE-2025-38159 may lead to potential data leakage or system instability due to out-of-bounds read.
When was CVE-2025-38159 published?
CVE-2025-38159 was published as part of the ongoing security updates for the Linux kernel.