CVE-2025-38013
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38013
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38013.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38013
- Downstream
- Related
- Published
- 2025-06-18T09:28:22Z
- Modified
- 2025-10-18T02:05:03.094424Z
- Summary
- wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Set nchannels after allocating struct cfg80211scan_request
Make sure that nchannels is set after allocating the struct cfg80211registereddevice::intscan_req member. Seen with syzkaller:
UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211channel *[] _countedby(nchannels)' (aka 'struct ieee80211_channel *[]')
This was missed in the initial conversions because I failed to locate the allocation likely due to the "sizeof(void *)" not matching the "channels" array type.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/07c737d9ab02c07b562aefcca16aa95077368e24
- https://git.kernel.org/stable/c/82bbe02b2500ef0a62053fe2eb84773fe31c5a0a
- https://git.kernel.org/stable/c/e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81
- https://git.kernel.org/stable/c/fde33ab3c052a302ee8a0b739094b88ceae4dd67
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede3eac9f32ec04112b39e01b574ac739382469bf9Fixedfde33ab3c052a302ee8a0b739094b88ceae4dd67
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede3eac9f32ec04112b39e01b574ac739382469bf9Fixed07c737d9ab02c07b562aefcca16aa95077368e24
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede3eac9f32ec04112b39e01b574ac739382469bf9Fixede3192e999a0d05ea0ba2c59c09afaf0b8ee70b81
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede3eac9f32ec04112b39e01b574ac739382469bf9Fixed82bbe02b2500ef0a62053fe2eb84773fe31c5a0a
Affected versions
v6.*
v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.2
v6.12.20
v6.12.21
v6.12.22
v6.12.23
v6.12.24
v6.12.25
v6.12.26
v6.12.27
v6.12.28
v6.12.29
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.14.1
v6.14.2
v6.14.3
v6.14.4
v6.14.5
v6.14.6
v6.14.7
v6.15-rc1
v6.15-rc2
v6.15-rc3
v6.15-rc4
v6.15-rc5
v6.5
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.35
v6.6.36
v6.6.37
v6.6.38
v6.6.39
v6.6.4
v6.6.40
v6.6.41
v6.6.42
v6.6.43
v6.6.44
v6.6.45
v6.6.46
v6.6.47
v6.6.48
v6.6.49
v6.6.5
v6.6.50
v6.6.51
v6.6.52
v6.6.53
v6.6.54
v6.6.55
v6.6.56
v6.6.57
v6.6.58
v6.6.59
v6.6.6
v6.6.60
v6.6.61
v6.6.62
v6.6.63
v6.6.64
v6.6.65
v6.6.66
v6.6.67
v6.6.68
v6.6.69
v6.6.7
v6.6.70
v6.6.71
v6.6.72
v6.6.73
v6.6.74
v6.6.75
v6.6.76
v6.6.77
v6.6.78
v6.6.79
v6.6.8
v6.6.80
v6.6.81
v6.6.82
v6.6.83
v6.6.84
v6.6.85
v6.6.86
v6.6.87
v6.6.88
v6.6.89
v6.6.9
v6.6.90
v6.6.91
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7
Database specific
vanir_signatures
[
{
"digest": {
"function_hash": "302249480318952614767173203890634883875",
"length": 11874.0
},
"signature_type": "Function",
"target": {
"function": "ieee80211_register_hw",
"file": "net/mac80211/main.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81",
"id": "CVE-2025-38013-16558220"
},
{
"digest": {
"function_hash": "302249480318952614767173203890634883875",
"length": 11874.0
},
"signature_type": "Function",
"target": {
"function": "ieee80211_register_hw",
"file": "net/mac80211/main.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82bbe02b2500ef0a62053fe2eb84773fe31c5a0a",
"id": "CVE-2025-38013-2f57434b"
},
{
"digest": {
"function_hash": "18770708387042337997089481403438525716",
"length": 11617.0
},
"signature_type": "Function",
"target": {
"function": "ieee80211_register_hw",
"file": "net/mac80211/main.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fde33ab3c052a302ee8a0b739094b88ceae4dd67",
"id": "CVE-2025-38013-2feb2f29"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"98581043164946416468834004572585663426",
"213564448514578270104805189190308513516",
"359486072258303370947654172329113771",
"65492617785902715786145962042617157722",
"203079974101504130668104355628726765348",
"139047779167719132321846424407625772287",
"127374962619848297577060140174742158655"
]
},
"signature_type": "Line",
"target": {
"file": "net/mac80211/main.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fde33ab3c052a302ee8a0b739094b88ceae4dd67",
"id": "CVE-2025-38013-4798d079"
},
{
"digest": {
"function_hash": "286011570568310875211404730405241766867",
"length": 11757.0
},
"signature_type": "Function",
"target": {
"function": "ieee80211_register_hw",
"file": "net/mac80211/main.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07c737d9ab02c07b562aefcca16aa95077368e24",
"id": "CVE-2025-38013-5bb44750"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"298349985860056163997412119640960881064",
"23021237306192060186048337767677706474",
"234985309583809261802509535818893678414",
"65492617785902715786145962042617157722",
"203079974101504130668104355628726765348",
"139047779167719132321846424407625772287",
"127374962619848297577060140174742158655"
]
},
"signature_type": "Line",
"target": {
"file": "net/mac80211/main.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07c737d9ab02c07b562aefcca16aa95077368e24",
"id": "CVE-2025-38013-94458f94"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"298349985860056163997412119640960881064",
"23021237306192060186048337767677706474",
"234985309583809261802509535818893678414",
"65492617785902715786145962042617157722",
"203079974101504130668104355628726765348",
"139047779167719132321846424407625772287",
"127374962619848297577060140174742158655"
]
},
"signature_type": "Line",
"target": {
"file": "net/mac80211/main.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81",
"id": "CVE-2025-38013-a2ce55f4"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"298349985860056163997412119640960881064",
"23021237306192060186048337767677706474",
"234985309583809261802509535818893678414",
"65492617785902715786145962042617157722",
"203079974101504130668104355628726765348",
"139047779167719132321846424407625772287",
"127374962619848297577060140174742158655"
]
},
"signature_type": "Line",
"target": {
"file": "net/mac80211/main.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82bbe02b2500ef0a62053fe2eb84773fe31c5a0a",
"id": "CVE-2025-38013-e255c213"
}
]