AZL-64532
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-64532.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-64532
- Upstream
- Published
- 2025-07-03T09:15:31Z
- Modified
- 2026-04-01T05:20:21.193716Z
- Summary
- CVE-2025-38159 affecting package kernel for versions less than 6.6.96.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrol(rtwdev, para[0], ¶[1])', which reads 5 bytes:
void rtwfwbtwificontrol(struct rtwdev *rtwdev, u8 opcode, u8 *data) { ... SETBTWIFICONTROLDATA1(h2cpkt, *data); SETBTWIFICONTROLDATA2(h2cpkt, *(data + 1)); ... SETBTWIFICONTROLDATA5(h2c_pkt, *(data + 4));
Detected using the static analysis tool - Svace.
- References