In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads 5 bytes: void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data) { ... SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data); SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1)); ... SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4)); Detected using the static analysis tool - Svace.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/1ee8ea6937d13b20f90ff35d71ccc03ba448182d cve-icon cve-icon
https://git.kernel.org/stable/c/4c2c372de2e108319236203cce6de44d70ae15cd cve-icon cve-icon
https://git.kernel.org/stable/c/68a1037f0bac4de9a585aa9c879ef886109f3647 cve-icon cve-icon
https://git.kernel.org/stable/c/74e18211c2c89ab66c9546baa7408288db61aa0d cve-icon cve-icon
https://git.kernel.org/stable/c/9febcc8bded8be0d7efd8237fcef599b6d93b788 cve-icon cve-icon
https://git.kernel.org/stable/c/c13255389499275bc5489a0b5b7940ccea3aef04 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025070339-CVE-2025-38159-0c95@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-38159 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-38159 cve-icon
History

Fri, 04 Jul 2025 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Thu, 03 Jul 2025 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads 5 bytes: void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data) { ... SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data); SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1)); ... SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4)); Detected using the static analysis tool - Svace.
Title wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-07-03T08:36:01.490Z

Updated: 2025-07-03T08:36:01.490Z

Reserved: 2025-04-16T04:51:23.990Z

Link: CVE-2025-38159

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-07-03T09:15:31.163

Modified: 2025-07-03T15:13:53.147

Link: CVE-2025-38159

cve-icon Redhat

Severity : Important

Publid Date: 2025-07-03T00:00:00Z

Links: CVE-2025-38159 - Bugzilla