CVE-2025-38013

HIGH EPSS 6.0%
Published Jun 18, 20251y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Jun 18, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller: UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') This was missed in the initial conversions because I failed to locate the allocation likely due to the "sizeof(void *)" not matching the "channels" array type.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
6.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-129

Affected Products 9

VendorProductVersionRange
linuxlinux_kernel*≥6.6  –  <6.6.92
linuxlinux_kernel*≥6.7  –  <6.12.30
linuxlinux_kernel*≥6.13  –  <6.14.8
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any

References 4

  • git.kernel.org https://git.kernel.org/stable/c/07c737d9ab02c07b562aefcca16aa95077368e24
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/82bbe02b2500ef0a62053fe2eb84773fe31c5a0a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fde33ab3c052a302ee8a0b739094b88ceae4dd67
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/07c737d9ab02c07b562aefcca16aa95077368e24
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/82bbe02b2500ef0a62053fe2eb84773fe31c5a0a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fde33ab3c052a302ee8a0b739094b88ceae4dd67
    Patch