wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 11 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() Preserve the error code if iwl_setup_deferred_work() fails. The current code returns ERR_PTR(0) (which is NULL) on this path. I believe the missing error code potentially leads to a use after free involving debugfs.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/5c432da1ee191e9f7830dd516456706063d7bec3
- https://git.kernel.org/stable/c/f95598a133a905fd937354ad902773d05593b8b9
- https://git.kernel.org/stable/c/991e2066f6009d3cb898413058c62dbcc92bd6d2
- https://git.kernel.org/stable/c/1d068272c21d886d06526454b68368100ba0a720
- https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-25546
- GCVE · GCVE-0-2025-38656
CERT-FR advisories
- CERTFR-2026-AVI-0170 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1073 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1064 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0921 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0895 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0841 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0827 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0805 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0787 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.297 < 5.5cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.241 < 5.11cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.190 < 5.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.148 < 6.2cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.102 < 6.7cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.12.42 < 6.13
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected ca980f1911a7144d451d1c31298ab8507c6bd88f < 5c432da1ee191e9f7830dd516456706063d7bec3 ; affected 7dd6350307af6521b6240b295c93b7eec4daebe6 < f95598a133a905fd937354ad902773d05593b8b9 ; affected c0e43c3f6c0a79381b468574c241065998412b7c < 991e2066f6009d3cb898413058c62dbcc92bd6d2 ; affected 70a1b527eaea9430b1bd87de59f3b9f6bd225701 < 1d068272c21d886d06526454b68368100ba0a720 ; affected 90a0d9f339960448a3acc1437a46730f975efd6a < cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6 ; affected c80832d445653baba5ac80cd2c2637c437ac881b |
| Linux · Linux | affected 6.6.102 < 6.6.160 ; affected 6.12.42 < 6.12.114 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |