Linux Kernel Vulnerability in ath9k_htc Driver Leading to Device Crashes

CVE-2025-38157

What is CVE-2025-38157?

A vulnerability in the ath9k_htc driver within the Linux kernel allows a malicious USB device to trigger an event (WMI_SWBA_EVENTID) before beaconing is enabled. This results in a device-by-zero error, which can cause crashes or out of bounds reads, posing a risk to system stability. The vulnerability can be mitigated by aborting the event handling in the driver when beacons are not enabled.

References