Linux Kernel Vulnerability in Carl9170 Firmware Loading Process

CVE-2025-38420

What is CVE-2025-38420?

A vulnerability in the Linux kernel affects the carl9170 wireless device. It occurs when an attempt is made to ping a device that has failed to load its firmware. Since the device does not complete the 'ieee80211_register_hw()' process, it does not create the necessary internal workqueue managed by 'ieee80211_queue_work()'. This results in a null pointer dereference, potentially leading to crashes. The issue has been reported and a fix has been implemented in subsequent kernel updates.

References