CVE-2025-38013

What it actually does

Out-of-bounds array index access in mac80211 scan request handling caused by n_channels remaining unset after allocation of the int_scan_req structure, resulting in undefined behavior when accessing the channels array.

Why it matters to the business

Potential kernel crashes or memory corruption on affected Linux systems handling Wi-Fi scans, leading to denial of service; low likelihood of widespread exploitation given low EPSS and no KEV listing despite multiple related Linux kernel privilege escalation campaigns observed.

How an attack unfolds

An attacker triggers the vulnerable scan path via crafted wireless frames or local fuzzing input (as demonstrated by syzkaller), causing the kernel to index into an uninitialized channels array; similar techniques appear in Advanced Spyware Campaign and Linux Kernel Privilege Escalation activity involving CVE-2025-38350, CVE-2025-38477, CVE-2025-37890 and CVE-2025-38083.

How to fix it

Update the Linux kernel to commit fde33ab3c052a302ee8a0b739094b88ceae4dd67 or later; for cups-filters on Mageia 5 apply package version 1.0.71-1.2.mga5.

How to confirm the fix worked

Verify the presence of commit fde33ab3c052a302ee8a0b739094b88ceae4dd67 in the running kernel source; recompile with UBSAN enabled and confirm absence of the array-index-out-of-bounds report on scan paths.

Typical attack path

1. Obtain local or adjacent network access to a vulnerable Linux kernel with mac80211 Wi-Fi enabled
2. Craft input that reaches cfg80211_scan_request allocation without proper n_channels initialization
3. Trigger array access at net/mac80211/scan.c:1208 resulting in out-of-bounds read/write
4. Leverage resulting memory corruption for crash or privilege escalation

How to detect it

Review kernel logs for UBSAN reports referencing scan.c:1208 or array-index-out-of-bounds in mac80211; correlate with wireless interface activity and any related privilege escalation attempts seen in Advanced Spyware Campaign or listed Linux kernel exploits.

What your security team should do

• Prioritize kernel updates on all Wi-Fi enabled Linux hosts within the next maintenance window
• Monitor for similar buffer handling issues in mac80211 and related wireless subsystems
• Apply the exact fixed commit fde33ab3c052a302ee8a0b739094b88ceae4dd67 across stable trees