CVE-2025-38157

What it actually does

A malicious USB device can send a WMI_SWBA_EVENTID event to an ath9k_htc-managed device before beaconing is enabled, triggering a divide-by-zero error in ath9k_htc_swba() that results in a kernel crash or out-of-bounds read.

Why it matters to the business

Systems using affected Linux kernel versions with ath9k_htc wireless hardware may experience unexpected crashes or memory corruption when a malicious USB device is connected, leading to downtime and potential data exposure in environments with USB peripherals.

How an attack unfolds

An attacker connects a malicious USB device that emulates an ath9k_htc adapter and sends a WMI_SWBA_EVENTID event prematurely before beaconing is enabled, causing the driver to dereference a zero divisor and either crash the kernel or perform an out-of-bounds read.

How to fix it

Update the Linux kernel to a version containing commit e5ce9df1d68094d37360dbd9b09289d42fa21e54 or apply the fixed rpm package 4.16.1.3-1.2.mga8; disable the ath9k_htc driver if the hardware is not required.

How to confirm the fix worked

Verify the kernel source contains the check that aborts ath9k_htc_swba() when beacons are disabled; confirm the running kernel version matches or exceeds the listed fixed versions.

Typical attack path

1. Attacker prepares a malicious USB device capable of sending WMI events
2. Device is connected to a target system running an affected kernel with ath9k_htc
3. WMI_SWBA_EVENTID event is sent before beaconing has been enabled
4. ath9k_htc_swba() performs divide-by-zero leading to crash or OOB read

How to detect it

Review kernel logs for divide-by-zero faults or oops messages mentioning ath9k_htc_swba or WMI_SWBA_EVENTID; inspect USB device connection events preceding such crashes.

• ath9k_htc_swba
• WMI_SWBA_EVENTID
• divide-by-zero in ath9k_htc

What your security team should do

• Apply the kernel update containing the referenced commit or fixed rpm package as soon as possible
• Audit systems for ath9k_htc usage and restrict USB device access where feasible
• Monitor for kernel oops or panic logs referencing ath9k_htc_swba