Riskcovery

CVE-2025-38013

wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request

State
Published
Severity
Not scored
Published
Jun 18, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request

Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller:

UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')

This was missed in the initial conversions because I failed to locate the allocation likely due to the "sizeof(void *)" not matching the "channels" array type.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e3eac9f32ec04112b39e01b574ac739382469bf9 to before fde33ab3c052a302ee8a0b739094b88ceae4dd67Affected
  • e3eac9f32ec04112b39e01b574ac739382469bf9 to before 07c737d9ab02c07b562aefcca16aa95077368e24Affected
  • e3eac9f32ec04112b39e01b574ac739382469bf9 to before e3192e999a0d05ea0ba2c59c09afaf0b8ee70b81Affected
  • e3eac9f32ec04112b39e01b574ac739382469bf9 to before 82bbe02b2500ef0a62053fe2eb84773fe31c5a0aAffected
LinuxLinux
  • 6.6Affected
  • before 6.6Not affected
  • 6.6.92 through 6.6.*Not affected
  • 6.12.30 through 6.12.*Not affected
  • 6.14.8 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.