{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38656","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:24.030Z","datePublished":"2025-08-22T16:00:59.678Z","dateUpdated":"2026-08-05T12:03:42.882Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:03:42.882Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()\n\nPreserve the error code if iwl_setup_deferred_work() fails.  The current\ncode returns ERR_PTR(0) (which is NULL) on this path.  I believe the\nmissing error code potentially leads to a use after free involving\ndebugfs."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is only reachable through the iwlwifi driver's PCI probe / firmware-load callback and the `iwl_opmode_register()` path when the `iwldvm` module loads — local module-load or device-bind activity, not any network or wireless frame processing (the radio is not even up at this point).\nAC:L - Reaching the faulty branch requires `alloc_ordered_workqueue()` to fail with ENOMEM at one specific small allocation during a one-shot driver probe; an attacker can raise system-wide memory pressure but cannot influence the timing of a boot-time or hotplug probe, so success depends on conditions outside their control.\nPR:L - Driver probe is normally triggered by root (modprobe, sysfs bind/unbind) or by hotplug, but an unprivileged local user can supply the only other precondition — memory exhaustion — while a probe occurs, so basic local user privileges are assumed rather than full root.\nUI:N - No victim action beyond ordinary system operation is needed; the probe path executes automatically at boot, on module autoload, or on device hotplug.\nS:U - The freed objects and the stale debugfs dentry all live in the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The commit identifies a resulting use-after-free involving debugfs; `ieee80211_free_hw()` has already freed the `iwl_priv` allocation while `drv->dbgfs_op_mode` still references the orphaned tree, and a UAF on reclaimed slab memory can be leveraged to read attacker-chosen kernel data.\nI:H - The same use-after-free lets a reclaiming allocation overlap the freed object, giving a write primitive over kernel heap state that can be escalated to control-flow corruption.\nA:H - The driver is left in a half-torn-down state with a dangling debugfs reference, and dereferencing freed memory produces an oops/panic — a full availability loss, on top of the WiFi device being permanently unusable."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/dvm/main.c"],"versions":[{"version":"c0e43c3f6c0a79381b468574c241065998412b7c","lessThan":"991e2066f6009d3cb898413058c62dbcc92bd6d2","status":"affected","versionType":"git"},{"version":"70a1b527eaea9430b1bd87de59f3b9f6bd225701","lessThan":"1d068272c21d886d06526454b68368100ba0a720","status":"affected","versionType":"git"},{"version":"90a0d9f339960448a3acc1437a46730f975efd6a","lessThan":"cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6","status":"affected","versionType":"git"},{"version":"c80832d445653baba5ac80cd2c2637c437ac881b","status":"affected","versionType":"git"},{"version":"b398120fbe0acfef60b16f6a0f69902d385d7728","status":"affected","versionType":"git"},{"version":"2e9f85ee3b46453a2f250a57d3a9f10c70c71202","status":"affected","versionType":"git"},{"version":"6663c52608d8d8727bf1911e6d9218069ba1c85e","status":"affected","versionType":"git"},{"version":"ca980f1911a7144d451d1c31298ab8507c6bd88f","status":"affected","versionType":"git"},{"version":"7dd6350307af6521b6240b295c93b7eec4daebe6","status":"affected","versionType":"git"},{"version":"5.4.297","lessThan":"5.5","status":"affected","versionType":"semver"},{"version":"5.10.241","lessThan":"5.11","status":"affected","versionType":"semver"},{"version":"5.15.190","lessThan":"5.16","status":"affected","versionType":"semver"},{"version":"6.1.148","lessThan":"6.2","status":"affected","versionType":"semver"},{"version":"6.6.102","lessThan":"6.7","status":"affected","versionType":"semver"},{"version":"6.12.42","lessThan":"6.13","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/dvm/main.c"]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.297"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.241"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.190"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.102"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.42"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/991e2066f6009d3cb898413058c62dbcc92bd6d2"},{"url":"https://git.kernel.org/stable/c/1d068272c21d886d06526454b68368100ba0a720"},{"url":"https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6"}],"title":"wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()","x_generator":{"engine":"bippy-1.2.0"}}}}