CVE-2025-38656wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() Preserve the error code if iwl_setup_deferred_work() fails. The current code returns ERR_PTR(0) (which is NULL) on this path. I believe the missing error code potentially leads to a use after free involving debugfs.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 21, 2026
- First seen by InfoSec Signals
- Oct 21, 2026
Affected products
Linux Linux linux:linux (from the name) | from ca980f1911a7144d451d1c31298ab8507c6bd88f before 5c432da1ee191e9f7830dd516456706063d7bec3; from 7dd6350307af6521b6240b295c93b7eec4daebe6 before f95598a133a905fd937354ad902773d05593b8b9; from c0e43c3f6c0a79381b468574c241065998412b7c before 991e2066f6009d3cb898413058c62dbcc92bd6d2; 70a1b527eaea9430b1bd87de59f3b9f6bd225701 builds before 1d068272c21d886d06526454b68368100ba0a720; from 90a0d9f339960448a3acc1437a46730f975efd6a before cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6; c80832d445653baba5ac80cd2c2637c437ac881b; b398120fbe0acfef60b16f6a0f69902d385d7728; 2e9f85ee3b46453a2f250a57d3a9f10c70c71202; and 5 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | from 5.4.297 before 5.5; from 5.10.241 before 5.11; from 5.15.190 before 5.16; from 6.1.148 before 6.2; from 6.6.102 before 6.7; from 6.12.42 before 6.13 | NVD |
References
- https://git.kernel.org/stable/c/5c432da1ee191e9f7830dd516456706063d7bec3
- https://git.kernel.org/stable/c/f95598a133a905fd937354ad902773d05593b8b9
- https://git.kernel.org/stable/c/991e2066f6009d3cb898413058c62dbcc92bd6d2patch
- https://git.kernel.org/stable/c/1d068272c21d886d06526454b68368100ba0a720patch
- https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.