Critical Firmware Loading Vulnerability in Linux Kernel - CVE-2025-38420
Summary
CVE-2025-38420: In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: do not ping device which has failed to load firmware Syzkaller reports [1, 2] crashes caused by an attempts to ping the device which has... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware architectures and is known for its stability, performance, and security features. However, vulnerabilities can arise, such as the one identified in CVE-2025-38420, which affects the kernel's handling of firmware loading for specific wireless devices.
Vulnerability Detail
CVE-2025-38420 is a vulnerability in the Linux kernel that occurs when the system attempts to ping a wireless device that has failed to load its firmware. This situation arises because the device does not complete the initialization process, specifically failing to pass 'ieee80211_register_hw()'. As a result, an internal workqueue managed by 'ieee80211_queue_work()' is not created, leading to a null pointer dereference (null-ptr-deref) when the system tries to queue work on it. This vulnerability can cause system crashes and instability, particularly affecting wireless connectivity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected wireless devices until the kernel is updated to the patched version. Additionally, ensuring that devices are properly initialized and firmware is loaded before attempting to ping them can help mitigate the issue.
Conclusion
CVE-2025-38420 is a critical vulnerability in the Linux kernel that can lead to system crashes due to improper handling of firmware loading for wireless devices. Users are advised to update their kernel to the latest patched version to mitigate this issue. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38420 is a vulnerability in the Linux kernel that can cause system crashes when attempting to ping wireless devices that have failed to load firmware.
This vulnerability can lead to system instability and crashes, particularly affecting wireless connectivity and device management.
The vulnerability affects all versions of the Linux kernel prior to the fixed version 6.12.35-1 for Debian 13, as well as earlier versions for Debian 11 and 12.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate update is not possible, avoid using the affected wireless devices and ensure they are properly initialized before use.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
