CVE-2025-38292

What it actually does

Use-after-free in ath12k_dp_rx_msdu_coalesce() where rxcb->is_continuation is accessed after the skb has been freed, allowing invalid memory access in the Linux kernel WiFi receive path.

Why it matters to the business

Affected Linux systems with ath12k hardware risk kernel instability, crashes, or potential escalation; widespread kernel deployments and rising exploit interest amplify exposure for organizations relying on these drivers.

How an attack unfolds

An attacker triggers specific MSDU coalescing conditions in the ath12k receive path to free an skb while a reference remains, then reuses the freed memory; observed threat actors in related Linux kernel privilege-escalation campaigns demonstrate similar patterns that could be adapted.

How to fix it

Upgrade linux-lts to 6.6.58-r0 or later; apply commit 371b340affa52f280f6eadfd25fbd43f09f0d5c0 from the stable Linux git tree; rebuild and reboot affected kernels.

How to confirm the fix worked

Confirm kernel version or git commit after upgrade; recompile with the patch and verify ath12k_dp_rx_msdu_coalesce() no longer accesses freed rxcb fields.

Typical attack path

1. Identify target systems running vulnerable ath12k-enabled kernels
2. Send crafted 802.11 frames that exercise ath12k_dp_rx_msdu_coalesce()
3. Force skb free while is_continuation field is later dereferenced
4. Leverage resulting UAF for memory corruption or control-flow hijack

How to detect it

Review kernel crash logs and oops reports for ath12k receive-path dereferences after free; correlate with wireless frame capture timestamps and look for patterns matching known spyware or privilege-escalation toolkits targeting similar kernel flaws.

What your security team should do

• Prioritize patching Linux kernels containing ath12k to the listed fixed versions within standard change windows
• Monitor EPSS trend and related privilege-escalation campaigns for acceleration signals
• Restrict wireless interfaces on high-value systems until patches are deployed
• Include the fixed commit in automated kernel build pipelines