CVE-2025-38657

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then that would result in shift wrapping and potentially an out of bounds access later. In fact, we can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15).

Fortunately, only root can write to debugfs files so the security impact is minimal.

This vulnerability does not affect Red Hat Enterprise Linux or other Red Hat products because the vulnerable code was never introduced into supported kernel builds. In upstream environments, triggering this flaw requires administrative privileges to write to debugfs interfaces, inherently limiting the security risk. Consequently, Red Hat deployments face no operational impact.