CVE-2025-38045

What it actually does

Incorrect sequencing of debug actions in the iwlwifi driver causes firmware dump split and reset to occur in the wrong order, resulting in device crashes when debug configurations are applied.

Why it matters to the business

Wireless hardware on affected Linux systems can become unstable or crash during debugging, leading to connectivity loss and operational disruption for Wi-Fi dependent workloads.

How an attack unfolds

An attacker with local access applies debug configurations to the iwlwifi driver; the flawed action order triggers a race that crashes the wireless firmware or device, potentially aiding further attacks as seen in related kernel privilege escalation campaigns by groups targeting Linux.

How to fix it

Update the Linux kernel to commit 2b790fe67ed483d86c1aeb8be6735bf792caa7e5 or later; for Mageia 5 systems update python-rsa to 3.1.4-6.1.mga5.

How to confirm the fix worked

Verify the running kernel contains commit 2b790fe67ed483d86c1aeb8be6735bf792caa7e5; test debug configuration application without inducing crashes.

Typical attack path

1. Identify systems running vulnerable iwlwifi driver versions
2. Obtain local access or trigger debug configuration paths
3. Apply debug config to induce incorrect dump/reset ordering
4. Cause device crash to disrupt operations or chain into escalation

How to detect it

Review kernel logs for iwlwifi debug and firmware reset messages around device crashes; correlate with threat actor activity involving Linux kernel privilege escalation.

• iwlwifi: fix debug actions order
• dump split
• FW reset only in the middle of the dump

What your security team should do

• Prioritize kernel updates on all systems using iwlwifi
• Monitor wireless driver logs for crash indicators
• Restrict debug configuration access until patched
• Review downstream dependents for impact