CVE-2025-38317 (GCVE-0-2025-38317)
Vulnerability from cvelistv5
Published
2025-07-10 07:42
Modified
2026-08-05 12:01
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately, this is debugfs so it's limited to root users.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3f73c24f28b317f22df7870c25ff82f1d625c6c2
Version: 3f73c24f28b317f22df7870c25ff82f1d625c6c2
Version: 3f73c24f28b317f22df7870c25ff82f1d625c6c2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0c57aa8ef94cffc5c2d68230e19329a03e71a94f",
              "status": "affected",
              "version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2",
              "versionType": "git"
            },
            {
              "lessThan": "8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3",
              "status": "affected",
              "version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2",
              "versionType": "git"
            },
            {
              "lessThan": "8c7a5031a6b0d42e640fbd2d5d05f61f74e32dce",
              "status": "affected",
              "version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix buffer overflow in debugfs\n\nIf the user tries to write more than 32 bytes then it results in memory\ncorruption.  Fortunately, this is debugfs so it\u0027s limited to root users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through a `write(2)` syscall on the local debugfs file `htt_stats_type` under the ath12k pdev directory. There is no network or over-the-air path to `ath12k_write_htt_stats_type()`.\nAC:L - A single unconditional `write()` with a length greater than 32 bytes deterministically overflows the `kzalloc(32)` buffer; there is no race, timing window, or memory-layout precondition outside the attacker\u0027s control. The attacker fully controls both the overflow length and every overflowed byte.\nPR:L - The debugfs node is mode 0600, but debugfs `uid=`/`gid=`/`mode=` mount options and vendor chown policies commonly delegate debugfs access to non-root system accounts on exactly the embedded/Android-class ath12k platforms (IPQ5332 APs, WCN7850 devices), so a low-privileged local account is a realistic attacker. This is consistent with prior kernel CNA debugfs scoring (CVE-2026-46190, CVE-2026-43380, CVE-2026-64251).\nUI:N - The attacker triggers the overflow entirely on their own by writing to the debugfs file; no victim action, mount, or interaction is required.\nS:U - The heap corruption occurs in kernel memory and is exploited within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow lets the attacker overwrite adjacent kmalloc-32 slab objects with chosen content, corrupting length/pointer/index fields that can be leveraged into an arbitrary kernel-memory read primitive and disclosure of arbitrary kernel data.\nI:H - This is an unbounded heap buffer overflow with fully attacker-controlled data and length into a general-purpose slab cache, giving a direct out-of-bounds write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - Overwriting adjacent slab objects and slab metadata reliably produces slab corruption, oops, or panic, and the attacker can repeat the write at will to guarantee a system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:07.527Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0c57aa8ef94cffc5c2d68230e19329a03e71a94f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c7a5031a6b0d42e640fbd2d5d05f61f74e32dce"
        }
      ],
      "title": "wifi: ath12k: Fix buffer overflow in debugfs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38317",
    "datePublished": "2025-07-10T07:42:23.841Z",
    "dateReserved": "2025-04-16T04:51:24.004Z",
    "dateUpdated": "2026-08-05T12:01:07.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.