CVE-2025-38656: linux kernel from 5.4.297 (inclusive), before 5.5 (exclusive), from 5.10.241 (inclusive), before 5.11 (exclusive)…

Affected technology

linux kernel · from 5.4.297 (inclusive), before 5.5 (exclusive)
linux

linux kernel · from 5.10.241 (inclusive), before 5.11 (exclusive)
linux

linux kernel · from 5.15.190 (inclusive), before 5.16 (exclusive)
linux

linux kernel · from 6.1.148 (inclusive), before 6.2 (exclusive)
linux

linux kernel · from 6.6.102 (inclusive), before 6.7 (exclusive)
linux

linux kernel · from 6.12.42 (inclusive), before 6.13 (exclusive)
linux

Linux · ca980f1911a7144d451d1c31298ab8507c6bd88f to before 5c432da1ee191e9f7830dd516456706063d7bec3, 7dd6350307af6521b6240b295c93b7eec4daebe6 to before f95598a133a905fd937354ad902773d05593b8b9, c0e43c3f6c0a79381b468574c241065998412b7c to before 991e2066f6009d3cb898413058c62dbcc92bd6d2, 70a1b527eaea9430b1bd87de59f3b9f6bd225701 to before 1d068272c21d886d06526454b68368100ba0a720, 90a0d9f339960448a3acc1437a46730f975efd6a to before cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6, c80832d445653baba5ac80cd2c2637c437ac881b, b398120fbe0acfef60b16f6a0f69902d385d7728, 2e9f85ee3b46453a2f250a57d3a9f10c70c71202, 6663c52608d8d8727bf1911e6d9218069ba1c85e, 5.4.297 to before 5.5, 5.10.241 to before 5.11, 5.15.190 to before 5.16, 6.1.148 to before 6.2
Linux

Linux · 6.6.102 to before 6.6.160, 6.12.42 to before 6.12.114
Linux

Component: Not specified by the source
File: drivers/net/wireless/intel/iwlwifi/dvm/main.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

A local attacker with low privileges can trigger a use-after-free error. Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not state a further attacker outcome.