CVE-2025-38317

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38317", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.004Z", "datePublished": "2025-07-10T07:42:23.841Z", "dateUpdated": "2026-10-15T21:52:14.132Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:07.527Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix buffer overflow in debugfs\n\nIf the user tries to write more than 32 bytes then it results in memory\ncorruption. Fortunately, this is debugfs so it's limited to root users."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through a `write(2)` syscall on the local debugfs file `htt_stats_type` under the ath12k pdev directory. There is no network or over-the-air path to `ath12k_write_htt_stats_type()`.\nAC:L - A single unconditional `write()` with a length greater than 32 bytes deterministically overflows the `kzalloc(32)` buffer; there is no race, timing window, or memory-layout precondition outside the attacker's control. The attacker fully controls both the overflow length and every overflowed byte.\nPR:L - The debugfs node is mode 0600, but debugfs `uid=`/`gid=`/`mode=` mount options and vendor chown policies commonly delegate debugfs access to non-root system accounts on exactly the embedded/Android-class ath12k platforms (IPQ5332 APs, WCN7850 devices), so a low-privileged local account is a realistic attacker. This is consistent with prior kernel CNA debugfs scoring (CVE-2026-46190, CVE-2026-43380, CVE-2026-64251).\nUI:N - The attacker triggers the overflow entirely on their own by writing to the debugfs file; no victim action, mount, or interaction is required.\nS:U - The heap corruption occurs in kernel memory and is exploited within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow lets the attacker overwrite adjacent kmalloc-32 slab objects with chosen content, corrupting length/pointer/index fields that can be leveraged into an arbitrary kernel-memory read primitive and disclosure of arbitrary kernel data.\nI:H - This is an unbounded heap buffer overflow with fully attacker-controlled data and length into a general-purpose slab cache, giving a direct out-of-bounds write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - Overwriting adjacent slab objects and slab metadata reliably produces slab corruption, oops, or panic, and the attacker can repeat the write at will to guarantee a system crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c"], "versions": [{"version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2", "lessThan": "0c57aa8ef94cffc5c2d68230e19329a03e71a94f", "status": "affected", "versionType": "git"}, {"version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2", "lessThan": "8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3", "status": "affected", "versionType": "git"}, {"version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2", "lessThan": "8c7a5031a6b0d42e640fbd2d5d05f61f74e32dce", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0c57aa8ef94cffc5c2d68230e19329a03e71a94f"}, {"url": "https://git.kernel.org/stable/c/8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3"}, {"url": "https://git.kernel.org/stable/c/8c7a5031a6b0d42e640fbd2d5d05f61f74e32dce"}], "title": "wifi: ath12k: Fix buffer overflow in debugfs", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:49:33.642158Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:14.132Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:49:33.642158Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:49:34.631Z"}}], "cna": {"title": "wifi: ath12k: Fix buffer overflow in debugfs", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through a `write(2)` syscall on the local debugfs file `htt_stats_type` under the ath12k pdev directory. There is no network or over-the-air path to `ath12k_write_htt_stats_type()`.\nAC:L - A single unconditional `write()` with a length greater than 32 bytes deterministically overflows the `kzalloc(32)` buffer; there is no race, timing window, or memory-layout precondition outside the attacker's control. The attacker fully controls both the overflow length and every overflowed byte.\nPR:L - The debugfs node is mode 0600, but debugfs `uid=`/`gid=`/`mode=` mount options and vendor chown policies commonly delegate debugfs access to non-root system accounts on exactly the embedded/Android-class ath12k platforms (IPQ5332 APs, WCN7850 devices), so a low-privileged local account is a realistic attacker. This is consistent with prior kernel CNA debugfs scoring (CVE-2026-46190, CVE-2026-43380, CVE-2026-64251).\nUI:N - The attacker triggers the overflow entirely on their own by writing to the debugfs file; no victim action, mount, or interaction is required.\nS:U - The heap corruption occurs in kernel memory and is exploited within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow lets the attacker overwrite adjacent kmalloc-32 slab objects with chosen content, corrupting length/pointer/index fields that can be leveraged into an arbitrary kernel-memory read primitive and disclosure of arbitrary kernel data.\nI:H - This is an unbounded heap buffer overflow with fully attacker-controlled data and length into a general-purpose slab cache, giving a direct out-of-bounds write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - Overwriting adjacent slab objects and slab metadata reliably produces slab corruption, oops, or panic, and the attacker can repeat the write at will to guarantee a system crash."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2", "lessThan": "0c57aa8ef94cffc5c2d68230e19329a03e71a94f", "versionType": "git"}, {"status": "affected", "version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2", "lessThan": "8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3", "versionType": "git"}, {"status": "affected", "version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2", "lessThan": "8c7a5031a6b0d42e640fbd2d5d05f61f74e32dce", "versionType": "git"}], "programFiles": ["drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.34", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.3", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0c57aa8ef94cffc5c2d68230e19329a03e71a94f"}, {"url": "https://git.kernel.org/stable/c/8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3"}, {"url": "https://git.kernel.org/stable/c/8c7a5031a6b0d42e640fbd2d5d05f61f74e32dce"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix buffer overflow in debugfs\n\nIf the user tries to write more than 32 bytes then it results in memory\ncorruption. Fortunately, this is debugfs so it's limited to root users."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "6.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:07.527Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38317", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:14.132Z", "dateReserved": "2025-04-16T04:51:24.004Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-10T07:42:23.841Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0c57aa8ef94cffc5c2d68230e19329a03e71a94f", "status": "affected", "version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2", "versionType": "git"}, {"lessThan": "8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3", "status": "affected", "version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2", "versionType": "git"}, {"lessThan": "8c7a5031a6b0d42e640fbd2d5d05f61f74e32dce", "status": "affected", "version": "3f73c24f28b317f22df7870c25ff82f1d625c6c2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.34", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "51F754D9-F4F7-4E6E-BFD8-0BC3B2C2D498", "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Fix buffer overflow in debugfs\n\nIf the user tries to write more than 32 bytes then it results in memory\ncorruption. Fortunately, this is debugfs so it's limited to root users."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: Se corrige el desbordamiento de b\u00fafer en debugfs. Si el usuario intenta escribir m\u00e1s de 32 bytes, se produce una corrupci\u00f3n de memoria. Afortunadamente, esto es debugfs, por lo que est\u00e1 limitado a usuarios root."}], "id": "CVE-2025-38317", "lastModified": "2026-10-15T22:18:38.550", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38317", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:49:33.642158Z", "version": "2.0.3"}}]}, "published": "2025-07-10T08:15:30.703", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0c57aa8ef94cffc5c2d68230e19329a03e71a94f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8c7a5031a6b0d42e640fbd2d5d05f61f74e32dce"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: ath12k: Fix buffer overflow in debugfs", "id": "2379183", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379183"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38317", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38317\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38317\nhttps://lore.kernel.org/linux-cve-announce/2025071016-CVE-2025-38317-efbf@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:06:39.990978+00:00", "updated": "2025-07-13T11:06:39.991094+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}