CVE-2025-38157: Linux Kernel ath9k_htc DOS Vulnerability

CVE-2025-38157 Overview

CVE-2025-38157 is a vulnerability in the Linux kernel's ath9k_htc wireless driver. A malicious USB device can send a WMI_SWBA_EVENTID event before beaconing has been enabled on the host. This triggers a divide-by-zero condition in the driver, leading to a kernel crash or an out-of-bounds read.

The flaw affects the Linux kernel across multiple stable branches and Debian Linux 11. Exploitation requires local access through a physically or logically attached USB device presenting itself as an ath9k_htc-managed radio. The fix aborts ath9k_htc_swba() handling when beacons are not enabled.

Critical Impact

A malicious USB device can crash the kernel or trigger an out-of-bounds read in the ath9k_htc driver, resulting in denial of service or potential memory disclosure.

Affected Products

• Linux Kernel (multiple stable branches prior to the referenced fix commits)
• Debian Linux 11
• Systems using the ath9k_htc USB wireless driver

Discovery Timeline

• 2025-07-03 - CVE-2025-38157 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38157

Vulnerability Analysis

The vulnerability resides in ath9k_htc_swba(), the handler invoked when the firmware sends a Software Beacon Alert (WMI_SWBA_EVENTID) event over the WMI channel. The handler assumes beaconing has been configured before it processes the event. When a USB device sends this event out of sequence, the driver operates on uninitialized beacon state.

Processing the event without initialized beacon parameters causes a divide-by-zero in arithmetic that uses the beacon interval or slot count as a divisor. The same code path also indexes beacon-related arrays using values derived from the untrusted event, producing an out-of-bounds read. Both outcomes execute in kernel context. This flaw is classified as an out-of-bounds write class weakness [CWE-787].

Root Cause

The root cause is missing validation of driver state in the WMI event handler. The ath9k_htc driver trusts that the USB firmware only issues WMI_SWBA_EVENTID events after beaconing is enabled by the host. A malicious or malfunctioning USB device violates that assumption. The patch adds an explicit guard that aborts handling when beacons are disabled.

Attack Vector

Exploitation requires that an attacker attach a malicious USB device, or compromise firmware on an existing ath9k_htc-based adapter, so the device can emit crafted WMI events. The attacker then transmits a WMI_SWBA_EVENTID event before the host enables beaconing. The event is dispatched to ath9k_htc_swba(), which performs division by zero or reads outside the intended buffer.

The result is a kernel crash on the local host, or leakage of adjacent kernel memory through subsequent driver processing. No user authentication beyond local access to a USB port is required.

Detection Methods for CVE-2025-38157

Indicators of Compromise

• Unexpected kernel oops or panic messages referencing ath9k_htc_swba, ath9k_htc, or divide error in dmesg and /var/log/kern.log.
• Repeated USB enumeration events for ath9k_htc-compatible vendor and product identifiers on hosts that do not normally use such adapters.
• Kernel address sanitizer (KASAN) reports of out-of-bounds reads inside the ath9k_htc module.

Detection Strategies

• Monitor kernel logs for crash signatures inside the ath9k_htc driver and correlate with recent USB device insertion events from udev.
• Track loaded kernel modules across the fleet and alert when ath9k_htc is loaded on systems that do not require it.
• Baseline USB device inventories and flag unauthorized wireless adapters attached to servers, workstations, and kiosks.

Monitoring Recommendations

• Forward dmesg, journald, and auditd events to a central log platform and build detections for ath9k_htc fault strings.
• Enable USB device auditing through usbguard or equivalent controls to record insertions and enforce allow-lists.
• Track kernel package versions in configuration management to confirm patched builds are deployed.

How to Mitigate CVE-2025-38157

Immediate Actions Required

• Apply the Linux kernel updates from your distribution containing the upstream fix commits, including 0281c190, 40471b23, 5482ef98, 5a85c21f, 7ee3fb62, ac4e317a, e5ce9df1, and ee5ee646.
• Update Debian 11 systems using the security advisories in the Debian LTS Announcement 2025-07 and Debian LTS Announcement 2025-08.
• Restrict physical and logical USB access on high-value systems until patches are deployed.

Patch Information

The upstream fix modifies ath9k_htc_swba() to return early when beaconing is not enabled, preventing the divide-by-zero and out-of-bounds read. Fix commits are available in the mainline and stable kernel trees, including Kernel Git Commit 0281c19 and Kernel Git Commit ee5ee64. Debian users should install kernel packages referenced in the LTS advisories linked above.

Workarounds

• Blacklist the ath9k_htc module on systems that do not require Atheros USB wireless adapters using /etc/modprobe.d/.
• Deploy usbguard policies to block unknown USB devices, particularly wireless adapters, from attaching to sensitive hosts.
• Physically disable or remove unused USB ports on servers and appliances where USB connectivity is not required.

# Blacklist the vulnerable driver until patched kernels are deployed
echo 'blacklist ath9k_htc' | sudo tee /etc/modprobe.d/blacklist-ath9k_htc.conf
sudo rmmod ath9k_htc 2>/dev/null || true
sudo update-initramfs -u

# Verify the running kernel version after patching
uname -r