NetSight
IP …
high7.1

CVE-2025-38159

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 in…

Impact

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads 5 bytes: void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data) { ... SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data); SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1)); ... SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4)); Detected using the static analysis tool - Svace.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.4 before 5.15.186
from 5.16 before 6.1.142
from 6.2 before 6.6.94
from 6.7 before 6.12.34
from 6.13 before 6.15.3
DebianDebian Linux
Version 11.0

Weakness classification

CWE-125

References