{"id":"CVE-2025-38292","title":"wifi: ath12k: fix invalid access to memory","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix invalid access to memory\n\nIn ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean\nis_continuation is part of rxcb.\nCurrently, after free…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 920c2db46ca4476c25ec52758441e2e7ab498b0f","Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 371b340affa52f280f6eadfd25fbd43f09f0d5c0","Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 5f09d16cd57764c95c8548fe5b70672c9ac01127","Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 9f17747fbda6fca934854463873c4abf8061491d","Linux 6.3"],"published":"2025-07-10","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:36:59.074Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38292","references":[{"url":"https://git.kernel.org/stable/c/920c2db46ca4476c25ec52758441e2e7ab498b0f"},{"url":"https://git.kernel.org/stable/c/371b340affa52f280f6eadfd25fbd43f09f0d5c0"},{"url":"https://git.kernel.org/stable/c/5f09d16cd57764c95c8548fe5b70672c9ac01127"},{"url":"https://git.kernel.org/stable/c/9f17747fbda6fca934854463873c4abf8061491d"}],"tags":["cve.org"],"epss":0.00308,"epssPercentile":0.23504,"ingestedAt":"2026-10-21T12:48:53.704Z","slug":"CVE-2025-38292","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix invalid access to memory\n\nIn ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean\nis_continuation is part of rxcb.\nCurrently, after freeing the skb, the rxcb->is_continuation accessed\nagain which is wrong since the memory is already freed.\nThis might lead use-after-free error.\n\nHence, fix by locally defining bool is_continuation from rxcb,\nso that after freeing skb, is_continuation can be used.\n\nCompile tested only.\n\n## Affected\n\n- `Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 920c2db46ca4476c25ec52758441e2e7ab498b0f`\n- `Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 371b340affa52f280f6eadfd25fbd43f09f0d5c0`\n- `Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 5f09d16cd57764c95c8548fe5b70672c9ac01127`\n- `Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 9f17747fbda6fca934854463873c4abf8061491d`\n- `Linux 6.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}