Linux Kernel Vulnerability Affecting iwlwifi Driver

CVE-2025-38656

What is CVE-2025-38656?

A vulnerability in the iwlwifi driver of the Linux kernel allows for improper error handling during the initialization process. Specifically, if iwl_setup_deferred_work() fails, the driver erroneously returns a NULL pointer instead of the appropriate error code. This oversight may result in a use-after-free condition involving debugfs, posing potential risks to system integrity and stability. It is crucial for system administrators and users of Linux-based systems to ensure they are on updated versions of the kernel to mitigate this vulnerability.

References