What’s Vulnerable › Vulnerabilities

CVE-2025-38406: wifi: ath6kl: remove WARN on bad firmware input

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-25 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: remove WARN on bad firmware input If the firmware gives bad input, that's nothing to do with the driver's stack at this point etc., so the WARN_ON() doesn't add any value. Additionally, this is one of the top syzbot reports now. Just print a message, and as an added bonus, print the sizes too.

Affected products

• Debian Linux: 11.0
• Linux kernel: before 5.4.296; from 5.5 before 5.10.240; from 5.11 before 5.15.187; from 5.16 before 6.1.144; from 6.2 before 6.6.97; from 6.7 before 6.12.37 — fixed in 5.10.240, 5.15.187, 5.4.296, 6.1.144, 6.12.37, 6.15.6

How to fix

Upgrade to a fixed version: Linux kernel 5.10.240, 5.15.187, 5.4.296, 6.1.144. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/27d07deea35ae67f2e75913242e25bdb7e1114e5
• https://git.kernel.org/stable/c/327997afbb5e62532c28c1861ab5534c01969c9a
• https://git.kernel.org/stable/c/347827bd0c5680dac2dd59674616840c4d5154f1
• https://git.kernel.org/stable/c/46b47d4b06fa7f234d93f0f8ac43798feafcff89
• https://git.kernel.org/stable/c/7a2afdc5af3b82b601f6a2f0d1c90d5f0bc27aeb
• https://git.kernel.org/stable/c/89bd133529a4d2d68287128b357e49adc00ec690
• https://git.kernel.org/stable/c/e6c49f0b203a987c306676d241066451b74db1a5
• https://git.kernel.org/stable/c/e7417421d89358da071fd2930f91e67c7128fbff
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Get alerted when CVE-2025-38406 or the next vulnerability affects your stack