Linux Kernel Vulnerability in Wifi Management by Vendor Linux

CVE-2025-38657

What is CVE-2025-38657?

A vulnerability in the Linux kernel's wifi management component has been identified where an incorrect 'link_id' value from the user via debugfs could lead to shift wrapping. This potentially results in out-of-bounds access, which could compromise system integrity. The vulnerability limits the 'link_id' to a maximum of 15, aligning with IEEE80211_MLD_MAX_NUM_LINKS. Given that only root users can write to debugfs files, the security implications are minimized but still warrant attention.

References