In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software beacon handling if disabled A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds read. Prevent this by aborting the handling in ath9k_htc_swba() if beacons are not enabled.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0281c19074976ec48f0078d50530b406ddae75bc cve-icon cve-icon
https://git.kernel.org/stable/c/40471b23147c86ea3ed97faee79937c618250bd0 cve-icon cve-icon
https://git.kernel.org/stable/c/5482ef9875eaa43f0435e14570e1193823de857e cve-icon cve-icon
https://git.kernel.org/stable/c/5a85c21f812e02cb00ca07007d88acdd42d08c46 cve-icon cve-icon
https://git.kernel.org/stable/c/7ee3fb6258da8c890a51b514f60d7570dc703605 cve-icon cve-icon
https://git.kernel.org/stable/c/ac4e317a95a1092b5da5b9918b7118759342641c cve-icon cve-icon
https://git.kernel.org/stable/c/e5ce9df1d68094d37360dbd9b09289d42fa21e54 cve-icon cve-icon
https://git.kernel.org/stable/c/ee5ee646385f5846dcbc881389f3c44a197c402a cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025070338-CVE-2025-38157-bc8c@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-38157 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-38157 cve-icon
History

Fri, 04 Jul 2025 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Thu, 03 Jul 2025 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software beacon handling if disabled A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds read. Prevent this by aborting the handling in ath9k_htc_swba() if beacons are not enabled.
Title wifi: ath9k_htc: Abort software beacon handling if disabled
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-07-03T08:35:59.734Z

Updated: 2025-07-03T08:35:59.734Z

Reserved: 2025-04-16T04:51:23.990Z

Link: CVE-2025-38157

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-07-03T09:15:30.757

Modified: 2025-07-03T15:13:53.147

Link: CVE-2025-38157

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-07-03T00:00:00Z

Links: CVE-2025-38157 - Bugzilla