Buffer Overflow Vulnerability in Linux Kernel's ath12k Module
Summary
DEBIAN-CVE-2025-38317: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. The 'linux' package in Debian versions 13 and 14 is crucial for system stability and performance. This package includes various drivers and modules, including ath12k, which supports certain wireless network interfaces. The vulnerability in question arises from a flaw in the debugfs interface of the ath12k module, which can lead to memory corruption when improperly accessed.
Vulnerability Detail
In the Linux kernel, specifically within the ath12k module, a buffer overflow vulnerability has been identified. This issue occurs when a user attempts to write more than 32 bytes to the debugfs interface, leading to potential memory corruption. Since debugfs is primarily accessible to root users, the risk is somewhat mitigated, but it still poses a significant threat if exploited. The vulnerability is tracked under the identifier DEBIAN-CVE-2025-38317.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the debugfs interface or limit the operations that can be performed by non-root users. However, the best course of action is to apply the patch as soon as it is available.
Conclusion
The buffer overflow vulnerability in the Linux kernel's ath12k module poses a risk to users of Debian versions 13 and 14. It is crucial to update to the patched version 6.12.35-1 to mitigate this risk. Users are encouraged to monitor their systems and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for linux →
FAQ
A buffer overflow occurs when data exceeds the allocated space in memory, potentially overwriting adjacent memory and leading to unpredictable behavior or security vulnerabilities.
Users of Debian versions 13 and 14 with the 'linux' package installed are affected, particularly those using the ath12k wireless module.
While the vulnerability is limited to root users accessing debugfs, if an attacker gains root access, they could exploit this vulnerability to cause memory corruption.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider restricting access to the debugfs interface and monitoring for any unusual behavior in your system.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
