CVE-2025-38292

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix invalid access to memory

In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean is_continuation is part of rxcb. Currently, after freeing the skb, the rxcb->is_continuation accessed again which is wrong since the memory is already freed. This might lead use-after-free error.

Hence, fix by locally defining bool is_continuation from rxcb, so that after freeing skb, is_continuation can be used.

Compile tested only.

This patch addresses a use-after-free vulnerability in the ath12k_dp_rx_msdu_coalesce() function, where memory was accessed after freeing the associated skb. Specifically, the rxcb->is_continuation field was read post-free, leading to potential kernel crashes. The patch stores the value before freeing the buffer. The Required Privileges for CVSS is Low (PR:L), because triggering this flaw likely requires the ability to inject or manipulate network traffic handled by the Wi-Fi driver, which is feasible from a local user space process using standard socket interfaces or crafted packets.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module ath12k from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.