CVE-2025-38292: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38292 Overview

CVE-2025-38292 is a use-after-free vulnerability in the Linux kernel's ath12k Wi-Fi driver. The flaw resides in the ath12k_dp_rx_msdu_coalesce() function, where the rxcb control block is fetched from an skb (socket buffer). The code frees the skb but subsequently accesses rxcb->is_continuation, reading memory that has already been released. The issue affects Qualcomm Wi-Fi 7 (ath12k) hardware paths in the mainline Linux kernel and is categorized under [CWE-125] Out-of-Bounds Read.

Critical Impact
A local attacker with low privileges can trigger memory corruption in kernel space through the ath12k Wi-Fi data-path, potentially causing kernel crashes or exploitation of freed memory.

Affected Products

Linux Kernel (mainline versions containing the ath12k Wi-Fi driver prior to the fix)
Distributions shipping vulnerable stable kernel branches referenced by the upstream patches
Systems using Qualcomm Wi-Fi 7 chipsets driven by ath12k

Discovery Timeline

2025-07-10 - CVE-2025-38292 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38292

Vulnerability Analysis

The vulnerability exists in the receive data-path of the ath12k driver, which handles MSDU (MAC Service Data Unit) coalescing for received Wi-Fi frames. The function ath12k_dp_rx_msdu_coalesce() retrieves a receive control block (rxcb) from an skb. The control block stores per-packet metadata, including the boolean flag is_continuation used to identify continuation fragments of a larger MSDU.

During processing, the code path frees the underlying skb and then references rxcb->is_continuation in a subsequent conditional check. Because rxcb is stored inside the skb->cb control-buffer area, freeing the skb releases the memory backing rxcb. The later access dereferences pointer memory that is no longer valid, producing a classic use-after-free condition.

The upstream fix copies the is_continuation value into a local stack variable before freeing the skb, so the flag can be safely referenced afterward without touching released memory.

Root Cause

The root cause is an ordering error between resource release and metadata access. The skb and its embedded control buffer are freed before the driver finishes consuming state that lives inside that control buffer. Any allocator reuse or debug poisoning of the released region can produce stale, attacker-influenced, or corrupted values on the subsequent read.

Attack Vector

Exploitation requires local access with low privileges on a system that processes Wi-Fi traffic through the ath12k driver. An attacker who can influence the sequence of received MSDU fragments, or who can race the receive path, may trigger the vulnerable code sequence. The result is kernel memory corruption or an out-of-bounds read that impacts availability and confidentiality of kernel memory. No user interaction is required, and no remote network reachability is needed for the local attack scenario reflected in the CVSS vector.

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-38292

Indicators of Compromise

Kernel oops or panic messages referencing ath12k_dp_rx_msdu_coalesce or nearby symbols in the ath12k receive path.
KASAN (Kernel Address Sanitizer) reports flagging a use-after-free on skb->cb memory associated with ath12k receive processing.
Unexpected Wi-Fi interface resets, driver reloads, or system instability on hosts using Qualcomm Wi-Fi 7 hardware.

Detection Strategies

Inventory Linux hosts running kernels that include the ath12k driver and cross-reference against the fixed commits 371b340a, 5f09d16c, and 9f17747f.
Enable KASAN in test and staging kernels to surface use-after-free access patterns during Wi-Fi stress testing.
Correlate kernel ring-buffer messages (dmesg) with endpoint telemetry to identify repeated crashes tied to the Wi-Fi driver.

Monitoring Recommendations

Forward journalctl -k and /var/log/kern.log output to a centralized log platform and alert on ath12k fault signatures.
Track kernel version drift across the fleet so unpatched hosts on vulnerable stable branches are visible to security teams.
Monitor for repeated Wi-Fi interface flaps on laptops and edge devices, which can indicate driver-level memory faults.

How to Mitigate CVE-2025-38292

Immediate Actions Required

Apply the upstream stable kernel updates referenced by commits 371b340affa52f280f6eadfd25fbd43f09f0d5c0, 5f09d16cd57764c95c8548fe5b70672c9ac01127, and 9f17747fbda6fca934854463873c4abf8061491d.
Deploy the corresponding distribution kernel packages once vendors publish updated builds for supported stable branches.
Prioritize patching on multi-user Linux systems and shared workstations where local users could trigger the driver path.

Patch Information

The fix defines a local boolean holding the is_continuation value read from rxcb before the skb is freed, eliminating the post-free access. Patch details are available in the Kernel Patch for Stability, the Kernel Commit with Fixes, and the Kernel Update Commit.

Workarounds

Unload or blacklist the ath12k module on systems that do not require Qualcomm Wi-Fi 7 functionality until patches are applied.
Disable Wi-Fi radios on affected devices operating in high-risk or shared-user environments where kernel patching is delayed.
Restrict local shell access on multi-tenant hosts to reduce the population of users able to exercise the vulnerable driver path.

bash

# Verify running kernel version and ath12k module presence
uname -r
lsmod | grep ath12k

# Temporarily unload the driver (removes Wi-Fi functionality)
sudo modprobe -r ath12k

# Persistently blacklist the module until a patched kernel is deployed
echo 'blacklist ath12k' | sudo tee /etc/modprobe.d/blacklist-ath12k.conf
sudo update-initramfs -u