CVE-2025-38290 [Medium] | Security Vulnerability in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix node corruption in ar->arvifs list In current WLAN recovery code flow, ath12k_core_halt() only reinitializes the "arvifs" list head. This will cause the list node immediately following the list head to become an invalid list node. Because the prev of that node still points to the list head "arvifs", but the next of the list head "arvifs" no longer points to that list node. When a WLAN recovery occurs during the execution of a vif removal, and it happens before the spin_lock_bh(&ar->data_lock) in ath12k_mac_vdev_delete(), list_del() will detect the previously mentioned situation, thereby triggering a kernel panic. The fix is to remove and reinitialize all vif list nodes from the list head "arvifs" during WLAN halt. The reinitialization is to make the list nodes valid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute normally. Call trace: __list_del_entry_valid_or_report+0xd4/0x100 (P) ath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k] ath12k_scan_vdev_clean_work+0x40/0x164 [ath12k] cfg80211_wiphy_work+0xfc/0x100 process_one_work+0x164/0x2d0 worker_thread+0x254/0x380 kthread+0xfc/0x100 ret_from_fork+0x10/0x20 The change is mostly copied from the ath11k patch: https://lore.kernel.org/all/[email protected]/ Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-06	0.13%	0.31%	+0.17%
2	2025-11-20	0.02%	0.13%	+0.12%
3	2025-07-10	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-06

0.13%

0.31%

+0.17%

2025-11-20

0.02%

0.13%

+0.12%

2025-07-10

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

3.6

[email protected]

OS Trackers for CVE-2025-38290

vendor	priority	summary	link
`debian`	unimportant	CVE-2025-38290 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2025-38290
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2025-38290
`suse`	medium	CVE-2025-38290 severity moderate: SUSE including 476 source package names (2.1.3-6.67:kernel-default-base-6.4.0-32.1.21.10, 2.1.3-7.44:kernel-default-6.4.0-32.1, …), 1108 product×package rows across 216 product lines (Container suse/sl-micro/6.0/base-os-container, Container suse/sl-micro/6.0/kvm-os-container, … (216 product lines)): Fixed 627, Known Affected 231, Known Not Affected 229, First Fixed 21.	https://www.suse.com/security/cve/CVE-2025-38290/
`ubuntu`	medium	CVE-2025-38290 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1548 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1142, ignored 164, released 137, not-affected 100, needed 2, needs-triage 2, pending 1.	https://ubuntu.com/security/CVE-2025-38290

Affected software / configurations for CVE-2025-38290

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 6.3, < 6.6.94	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.7, < 6.12.34	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.13, < 6.15.3	cpe:2.3:o:linux:linux_kernel::::::::

References for CVE-2025-38290

URL	Tags
https://git.kernel.org/stable/c/6285516170f9e2f04b9dbf1e5100e0d7cbac22b4	Patch
https://git.kernel.org/stable/c/6bfe7ae9bbd9734751b853e2d2e1c13e8b46fd2d	Patch
https://git.kernel.org/stable/c/823435bd23108d6f8be89ea2d025c0e2e3769c51	Patch
https://git.kernel.org/stable/c/be049199dec9189602bc06e2c70eda3aa0f2ea6e	Patch

URL

CVE-2025-38290 | wifi: ath12k: fix node corruption in ar->arvifs list

Exploit prediction scoring system (EPSS) score for CVE-2025-38290

Common vulnerability scoring system (CVSS) metrics for CVE-2025-38290

Weakness enumeration for CVE-2025-38290

OS Trackers for CVE-2025-38290

Affected software / configurations for CVE-2025-38290

References for CVE-2025-38290