CVE-2025-38199: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38199 is a memory leak vulnerability in the Linux kernel's ath12k WiFi driver caused by redundant rx_stats allocations during repeated station additions. When ath12k_mac_station_add() is called multiple times for the same station, rx_stats is allocated each time without checking whether it already exists, resulting in unreleased memory. The vulnerability affects Linux kernel versions from 6.3 up to (but not including) 6.15.4. It was published on July 4, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the ath12k driver, arsta->rx_stats is allocated in ath12k_mac_station_add() each time a station is added, but no guard exists to check whether the allocation has already been performed. When the same station is added multiple times — a scenario that can occur in normal WiFi station management flows — each call leaks the previously allocated rx_stats buffer since the pointer is overwritten without freeing the old allocation. The fix adds a NULL check on arsta->rx_stats before allocating, preventing redundant allocations. The vulnerability was tested on QCN9274 hw2.0 and WCN7850 hw2.0 hardware (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation leads to progressive memory exhaustion on systems using the ath12k WiFi driver, with no impact on confidentiality or integrity. A local attacker with low privileges could repeatedly trigger station additions to cause kernel memory leaks, potentially degrading system performance or inducing a denial-of-service condition. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires local access with low privileges, limiting its attack surface. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The vulnerability is patched in Linux kernel version 6.15.4 and the 6.16-rc1 development branch. Two upstream patches have been committed to the stable kernel tree addressing the redundant allocation issue (Kernel Patch 1, Kernel Patch 2). Ubuntu has issued security notices USN-7833-1 through USN-7833-4 and USN-7856-1 addressing this CVE (Ubuntu USN-7833, Ubuntu USN-7856). Recommended actions: update to kernel 6.15.4 or later, apply distribution-specific patches, restrict local user access on systems with ath12k-based WiFi hardware, and monitor system memory usage for anomalies.