CVE-2025-38157 — Out-of-bounds Write in Linux

CWE-787 — Out-of-bounds WriteCWE-125 — Out-of-bounds Read69 documents8 sources
Severity
7.8HIGHNVD
OSV3.2
EPSS
0.0%
top 91.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedJul 3
Latest updateMar 25

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software beacon handling if disabled A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds read. Prevent this by aborting the handling in ath9k_htc_swba() if beacons are not enabled.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶NVDlinux/linux_kernel3.0 — 5.4.295+6
▶Debianlinux/linux_kernel< 5.10.244-1+3
▶Ubuntulinux/linux_kernel< 5.15.0-156.166+1
▶CVEListV5linux/linux832f6a18fc2aead14954c081ece03b7a5b425f81 — e5ce9df1d68094d37360dbd9b09289d42fa21e54+8

Also affects: Debian Linux 11.0

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

35
OSV
linux-azure-6.8 vulnerabilities↗2026-03-25
▶
OSV
linux-azure-fips vulnerabilities↗2026-03-04
▶
OSV
linux-azure vulnerabilities↗2026-03-04
▶
OSV
linux-ibm, linux-ibm-6.8 vulnerabilities↗2026-02-24
▶
OSV
linux-xilinx vulnerabilities↗2026-02-24
▶

📋Vendor Advisories

33
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-03-25
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-03-04
▶
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities↗2026-03-04
▶
Ubuntu
Linux kernel (Xilinx) vulnerabilities↗2026-02-24
▶
Ubuntu
Linux kernel (IBM) vulnerabilities↗2026-02-24
▶
CVE-2025-38157 — Out-of-bounds Write in Linux | cvebase