CVE-2025-38644: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38644 is a use of uninitialized resource vulnerability in the Linux kernel's mac80211 wireless subsystem, specifically in the ieee80211_tdls_oper() function. It affects Linux kernel versions from 3.17 through multiple stable branches, with fixed versions at 6.1.148, 6.6.102, 6.12.42, 6.15.10, and 6.16.1. Debian Linux 11.0 is also listed as an affected platform. The vulnerability was published on August 22, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). The vulnerability was discovered via syzbot fuzzing, which triggered a WARN_ON() in ieee80211_tdls_oper() by sending NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT, before association with an access point completed and without prior TDLS setup. This race condition leaves internal state — specifically sdata->u.mgd.tdls_peer — uninitialized, causing code paths that assume it is valid to trigger kernel warnings. The fix adds an early rejection of TDLS operations when the interface is not in station mode or not yet associated (Feedly, Red Hat Advisory).

A local attacker with low privileges can trigger kernel WARN_ON() assertions, potentially causing the kernel to become unstable or crash, resulting in a denial of service. The vulnerability has no impact on confidentiality or integrity — only system availability is affected. Systems running affected kernel versions with wireless interfaces in station mode are at risk, and the impact is limited to the local machine with no lateral movement potential (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability requires local access with low privileges and the ability to send netlink wireless configuration commands. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Upgrade to a patched Linux kernel version: 6.1.148 or later (for the 6.1.x branch), 6.6.102 or later (for 6.2–6.6.x), 6.12.42 or later (for 6.7–6.12.x), 6.15.10 or later (for 6.13–6.15.x), or 6.16.1 or later (for 6.16.x). Distributions including SUSE, openSUSE, Oracle Linux, and Debian have released updated kernel packages addressing this issue. As a workaround, restricting access to netlink wireless configuration interfaces (e.g., via capability controls or namespace isolation) to trusted users can reduce exposure (Red Hat Advisory, Feedly).

Red Hat published a security advisory tracking this CVE, and multiple Linux distribution vendors — including SUSE, openSUSE, and Oracle Linux — have issued kernel update advisories addressing this vulnerability. Coverage has been largely routine, consistent with standard Linux kernel patch releases, with no notable researcher commentary or significant social media discussion observed (Red Hat Advisory, Linux Security SUSE).