CVE-2025-38159 Details
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', which reads 5 bytes: void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data) { ... SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data); SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1)); ... SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4)); Detected using the static analysis tool - Svace.
A vulnerability in the Linux kernel's Wi-Fi driver can lead to an out-of-bounds read. This issue arises because the 'para' buffer size was incorrectly set to 2, while it should have been 6. The 'para' array is used in the 'rtw_fw_bt_wifi_control' function, which reads 5 bytes, creating a risk of reading beyond the allocated buffer. This vulnerability was identified through static analysis using the Svace tool.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1ee8ea6937d13b20f90ff35d71ccc03ba448182d | kernel.org | Patch |
| https://git.kernel.org/stable/c/4c2c372de2e108319236203cce6de44d70ae15cd | kernel.org | Patch |
| https://git.kernel.org/stable/c/68a1037f0bac4de9a585aa9c879ef886109f3647 | kernel.org | Patch |
| https://git.kernel.org/stable/c/74e18211c2c89ab66c9546baa7408288db61aa0d | kernel.org | Patch |
| https://git.kernel.org/stable/c/9febcc8bded8be0d7efd8237fcef599b6d93b788 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c13255389499275bc5489a0b5b7940ccea3aef04 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.4, < 5.15.186 >= 5.16, < 6.1.142 >= 6.2, < 6.6.94 >= 6.7, < 6.12.34 >= 6.13, < 6.15.3 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 18, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Jul 3, 2025 | New CVE Received | kernel.org |