CVE-2025-38157

A flaw was found in the Linux kernel's ath9k_htc Wi-Fi driver. A malicious Universal Serial Bus (USB) device can send a specific event (WMI_SWBA_EVENTID) before the Wi-Fi beaconing feature is enabled. This can lead to a critical error within the driver, potentially causing the system to crash (Denial of Service) or allowing an attacker to read sensitive information from memory (information disclosure).

This flaw is being treated as a Moderate Impact flaw, which leads to a Denial Of Service threat with a normal user. This vulnerability could even lead to a kernel information leak problem with a special group access privilege.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ath9k_htc kernel module from loading. This can be achieved by blacklisting the module.

Create a file named /etc/modprobe.d/blacklist-ath9k_htc.conf with the following content:

blacklist ath9k_htc

Then, regenerate the initramfs to apply the change:

dracut -f

A system reboot is required for this change to take effect. This mitigation will disable any functionality provided by the ath9k_htc module, which may impact WiFi connectivity if this specific hardware is in use.