---
id: CVE-2025-38292
title: 'wifi: ath12k: fix invalid access to memory'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath12k: fix invalid access to memory

  In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean
  is_continuation is part of rxcb.
  Currently, after free…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 <
    920c2db46ca4476c25ec52758441e2e7ab498b0f
  - >-
    Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 <
    371b340affa52f280f6eadfd25fbd43f09f0d5c0
  - >-
    Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 <
    5f09d16cd57764c95c8548fe5b70672c9ac01127
  - >-
    Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 <
    9f17747fbda6fca934854463873c4abf8061491d
  - Linux 6.3
published: '2025-07-10'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:36:59.074Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38292'
references:
  - url: 'https://git.kernel.org/stable/c/920c2db46ca4476c25ec52758441e2e7ab498b0f'
  - url: 'https://git.kernel.org/stable/c/371b340affa52f280f6eadfd25fbd43f09f0d5c0'
  - url: 'https://git.kernel.org/stable/c/5f09d16cd57764c95c8548fe5b70672c9ac01127'
  - url: 'https://git.kernel.org/stable/c/9f17747fbda6fca934854463873c4abf8061491d'
tags:
  - cve.org
epss: 0.00308
epssPercentile: 0.23504
ingestedAt: '2026-10-21T12:48:53.704Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix invalid access to memory

In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean
is_continuation is part of rxcb.
Currently, after freeing the skb, the rxcb->is_continuation accessed
again which is wrong since the memory is already freed.
This might lead use-after-free error.

Hence, fix by locally defining bool is_continuation from rxcb,
so that after freeing skb, is_continuation can be used.

Compile tested only.

## Affected

- `Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 920c2db46ca4476c25ec52758441e2e7ab498b0f`
- `Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 371b340affa52f280f6eadfd25fbd43f09f0d5c0`
- `Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 5f09d16cd57764c95c8548fe5b70672c9ac01127`
- `Linux >= d889913205cf7ebda905b1e62c5867ed4e39f6c2 < 9f17747fbda6fca934854463873c4abf8061491d`
- `Linux 6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.