CVE-2025-38420: wifi: carl9170: do not ping device which has failed to load firmware
In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: do not ping device which has failed to load firmware
Syzkaller reports [1, 2] crashes caused by an attempts to ping the device which has failed to load firmware. Since such a device doesn't pass 'ieee80211registerhw()', an internal workqueue managed by 'ieee80211queuework()' is not yet created and an attempt to queue work on it causes null-ptr-deref.
[1] https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff [2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38420?
CVE-2025-38420 is classified as a low-severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38420?
To fix CVE-2025-38420, upgrade to a patched version of the Linux kernel that addresses this vulnerability.
What software is affected by CVE-2025-38420?
CVE-2025-38420 affects the Linux kernel, specifically in its handling of the carl9170 wifi driver.
What could happen if CVE-2025-38420 is exploited?
Exploiting CVE-2025-38420 could lead to crashes when attempting to ping a device that has failed to load firmware.
Has CVE-2025-38420 been resolved?
Yes, CVE-2025-38420 has been resolved in a recent update to the Linux kernel.