CVE-2025-38643

What it actually does

Missing wiphy mutex acquisition in cfg80211_propagate_cac_done_wk worker before calling wdev_chandef, violating locking requirement and triggering WARN in net/wireless/chan.c during DFS/CAC propagation on mesh interfaces.

Why it matters to the business

Kernel warnings and potential instability in wireless mesh or DFS-enabled environments on affected Linux systems; high downstream package prevalence increases exposure across distributions, with remediation deadlines amplifying urgency for container and server fleets.

How an attack unfolds

Attacker with local access triggers mesh_peer_connected_dfs test conditions or equivalent CAC completion events that schedule cfg80211_propagate_cac_done_wk; the unlocked worker invokes wdev_chandef, hitting the warning path. Named actors such as VMSCAPE and campaigns targeting container-optimized OS privilege escalations (CVE-2024-58240, CVE-2025-39682) may chain this race for denial of service or further kernel exploitation.

How to fix it

Update to fixed package versions such as thunderbird (Debian:12) 1:128.13.0esr-1~deb12u1 or later kernel builds containing the mutex acquisition in cfg80211_check_and_end_cac; apply vendor kernel updates promptly given 431 days since publication and rising EPSS trend.

How to confirm the fix worked

Confirm absence of wdev_chandef warning in dmesg after running mesh_peer_connected_dfs test; verify mutex held via lockdep or code review of cfg80211_propagate_cac_done_wk; check installed package versions match listed fixed releases.

Typical attack path

1. Obtain local code execution or user presence on Linux host with cfg80211 wireless stack
2. Trigger DFS/CAC state propagation via mesh peer connection or regulatory events
3. Schedule the unlocked cfg80211_propagate_cac_done_wk work item
4. Observe or exploit resulting lock warning and inconsistent chandef state

How to detect it

Search kernel logs for the exact WARN at net/wireless/chan.c:1552 wdev_chandef and workqueue entries referencing cfg80211_propagate_cac_done_wk; correlate with mesh/DFS configuration changes or regulatory events; review for presence of threat actors VMSCAPE or container-OS escalation campaigns.

What your security team should do

• Prioritize kernel and wireless package upgrades to fixed versions within CISA-style timelines
• Monitor EPSS trend and threat actor activity around container OS privilege escalation chains
• Enable lockdep and warning logging in test environments to validate locking correctness
• Restrict local access on systems exposing wireless mesh or DFS features until patched