Home

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads 5 bytes: void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data) { ... SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data); SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1)); ... SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4)); Detected using the static analysis tool - Svace.

PUBLISHED Reserved 2025-04-16 | Published 2025-07-03 | Updated 2025-11-03 | Assigner Linux

Product status

Default status
unaffected

4136214f7c46839c15f0f177fe1d5052302c0205 (git) before 1ee8ea6937d13b20f90ff35d71ccc03ba448182d
affected

4136214f7c46839c15f0f177fe1d5052302c0205 (git) before 68a1037f0bac4de9a585aa9c879ef886109f3647
affected

4136214f7c46839c15f0f177fe1d5052302c0205 (git) before 74e18211c2c89ab66c9546baa7408288db61aa0d
affected

4136214f7c46839c15f0f177fe1d5052302c0205 (git) before c13255389499275bc5489a0b5b7940ccea3aef04
affected

4136214f7c46839c15f0f177fe1d5052302c0205 (git) before 9febcc8bded8be0d7efd8237fcef599b6d93b788
affected

4136214f7c46839c15f0f177fe1d5052302c0205 (git) before 4c2c372de2e108319236203cce6de44d70ae15cd
affected

Default status
affected

5.4
affected

Any version before 5.4
unaffected

5.15.186 (semver)
unaffected

6.1.142 (semver)
unaffected

6.6.94 (semver)
unaffected

6.12.34 (semver)
unaffected

6.15.3 (semver)
unaffected

6.16 (original_commit_for_fix)
unaffected

References

lists.debian.org/debian-lts-announce/2025/10/msg00008.html

git.kernel.org/...c/1ee8ea6937d13b20f90ff35d71ccc03ba448182d

git.kernel.org/...c/68a1037f0bac4de9a585aa9c879ef886109f3647

git.kernel.org/...c/74e18211c2c89ab66c9546baa7408288db61aa0d

git.kernel.org/...c/c13255389499275bc5489a0b5b7940ccea3aef04

git.kernel.org/...c/9febcc8bded8be0d7efd8237fcef599b6d93b788

git.kernel.org/...c/4c2c372de2e108319236203cce6de44d70ae15cd

cve.org (CVE-2025-38159)

nvd.nist.gov (CVE-2025-38159)

Download JSON