CVE-2025-38199: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38199 is a vulnerability discovered in the Linux kernel's WiFi subsystem, specifically in the ath12k driver. The vulnerability was disclosed on July 4, 2025, affecting the memory management of rx_stats allocation when adding stations (NVD Database).

The vulnerability occurs in the ath12k WiFi driver where redundant allocations of rx_stats happen when the same station is added multiple times. When ath12k_mac_station_add() is called repeatedly, rx_stats is allocated each time without checking for existing allocations. This was confirmed on QCN9274 hw2.0 PCI and WCN7850 hw2.0 PCI hardware platforms (Debian Tracker).

The vulnerability results in memory leaks in the Linux kernel's WiFi subsystem. When a station is added multiple times, the redundant allocations of rx_stats are not properly freed, leading to continuous memory consumption over time (NVD Database).

The fix involves implementing a check to prevent multiple allocations of rx_stats when ath12k_mac_station_add() is called repeatedly. The solution allocates arsta->rx_stats only if arsta->rx_stats is NULL, ensuring single allocation per station (Debian Tracker).