CVE-2025-38293: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38293 is a use-after-free/list corruption vulnerability in the Linux kernel's ath11k WiFi driver that can trigger a kernel panic during WLAN recovery. The flaw affects the ar->arvifs linked list management in ath11k_core_halt(), which only reinitializes the list head without properly cleaning up existing list nodes. Affected Linux kernel versions span 5.6–5.10.239, 5.11–5.15.186, 5.16–6.1.142, 6.2–6.6.94, 6.7–6.12.34, and 6.13–6.15.3; Debian Linux 11.0 is also listed as affected. It was published on July 10, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel patches).

The root cause is improper list node management (CWE-416 / use-after-free class) in ath11k_core_halt(): when WLAN recovery is triggered, the function calls INIT_LIST_HEAD(&ar->arvifs) to reinitialize the list head, but leaves existing arvif nodes with stale prev pointers still pointing to the old list head. This creates an inconsistent doubly-linked list state where the list head's next no longer points to the first node, but that node's prev still points to the head. If a virtual interface (vif) removal via ath11k_mac_op_remove_interface() races with the recovery — specifically before the spin_lock_bh(&ar->data_lock) is acquired — the subsequent list_del() call detects the corrupted list state and triggers a kernel panic via __list_del_entry_valid_or_report. The fix removes and reinitializes all vif list nodes from the arvifs list head during halt, ensuring list_del() operates on valid nodes (Feedly, kernel patches).

Successful exploitation causes a kernel panic, resulting in a complete system crash and denial of service. The impact is limited to availability (no confidentiality or integrity loss), but a system crash can cause unplanned downtime and potential data loss from in-flight operations. The attack vector is local and requires only low-privileged access, making it relevant in multi-tenant or shared-access Linux environments with ath11k-based WiFi hardware (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access and a specific race condition between WLAN recovery and vif removal, further limiting practical exploitability (Feedly).

Apply the upstream kernel patches available for all affected stable branches: 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34, and 6.15.3 (kernel patches). Ubuntu has issued security notices USN-7769-1, USN-7769-2, USN-7770-1, USN-7774-1/2/4/5, USN-7775-1/2, USN-7776-1, and USN-7789-2 covering various kernel flavors (Ubuntu USN-7769-1, Ubuntu USN-7774-1). Debian has accepted the fix into oldoldstable-security (linux 5.10.244-1). As a workaround where patching is not immediately possible, restrict local user access on systems with ath11k-based WiFi hardware and avoid triggering WLAN recovery during active interface removal operations.