CVE-2025-38159

wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

State: Published
Severity: Not scored
Published: Jul 3, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads 5 bytes:

void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data) { ... SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data); SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1)); ... SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));

Detected using the static analysis tool - Svace.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4136214f7c46839c15f0f177fe1d5052302c0205 to before 1ee8ea6937d13b20f90ff35d71ccc03ba448182dAffected 4136214f7c46839c15f0f177fe1d5052302c0205 to before 68a1037f0bac4de9a585aa9c879ef886109f3647Affected 4136214f7c46839c15f0f177fe1d5052302c0205 to before 74e18211c2c89ab66c9546baa7408288db61aa0dAffected 4136214f7c46839c15f0f177fe1d5052302c0205 to before c13255389499275bc5489a0b5b7940ccea3aef04Affected 4136214f7c46839c15f0f177fe1d5052302c0205 to before 9febcc8bded8be0d7efd8237fcef599b6d93b788Affected 4136214f7c46839c15f0f177fe1d5052302c0205 to before 4c2c372de2e108319236203cce6de44d70ae15cdAffected
LinuxLinux	5.4Affected before 5.4Not affected 5.15.186 through 5.15.Not affected 6.1.142 through 6.1.Not affected 6.6.94 through 6.6.Not affected 6.12.34 through 6.12.Not affected 6.15.3 through 6.15.*Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

4136214f7c46839c15f0f177fe1d5052302c0205 to before 1ee8ea6937d13b20f90ff35d71ccc03ba448182dAffected
4136214f7c46839c15f0f177fe1d5052302c0205 to before 68a1037f0bac4de9a585aa9c879ef886109f3647Affected
4136214f7c46839c15f0f177fe1d5052302c0205 to before 74e18211c2c89ab66c9546baa7408288db61aa0dAffected
4136214f7c46839c15f0f177fe1d5052302c0205 to before c13255389499275bc5489a0b5b7940ccea3aef04Affected
4136214f7c46839c15f0f177fe1d5052302c0205 to before 9febcc8bded8be0d7efd8237fcef599b6d93b788Affected
4136214f7c46839c15f0f177fe1d5052302c0205 to before 4c2c372de2e108319236203cce6de44d70ae15cdAffected

LinuxLinux

5.4Affected
before 5.4Not affected
5.15.186 through 5.15.*Not affected
6.1.142 through 6.1.*Not affected
6.6.94 through 6.6.*Not affected
6.12.34 through 6.12.*Not affected
6.15.3 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.