CVE-2025-38420

wifi: carl9170: do not ping device which has failed to load firmware

MEDIUM

5.5

CVSS Score

Published: July 25, 2025 at 02:16 PM UTC

Updated: June 17, 2026 at 09:16 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: do not ping device which has failed to load firmware Syzkaller reports [1, 2] crashes caused by an attempts to ping the device which has failed to load firmware. Since such a device doesn't pass 'ieee80211_register_hw()', an internal workqueue managed by 'ieee80211_queue_work()' is not yet created and an attempt to queue work on it causes null-ptr-deref. [1] https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff [2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

2.6.38 ≤ v < 5.10.2392.6.38 ≤ v < 5.15.1862.6.38 ≤ v < 5.4.2952.6.38 ≤ v < 6.1.1422.6.38 ≤ v < 6.12.352.6.38 ≤ v < 6.15.42.6.38 ≤ v < 6.162.6.38 ≤ v < 6.6.955.11 ≤ v < 5.15.1865.16 ≤ v < 6.1.1425.5 ≤ v < 5.10.2396.13 ≤ v < 6.15.46.2 ≤ v < 6.6.956.7 ≤ v < 6.12.352.6.38 6.16 rc1 6.16 rc2e4a668c59080f862af3ecc28b359533027cbe434

Vendor states this is fixed in 0140d3d37f0f1759d1fdedd854c7875a86e15f8d (fixed)

Vendor states this is fixed in 11ef72b3312752c2ff92f3c1e64912be3228ed36 (fixed)

Vendor states this is fixed in 15d25307692312cec4b57052da73387f91a2e870 (fixed)

Vendor states this is fixed in 301268dbaac8e9013719e162a000202eac8054be (fixed)

Vendor states this is fixed in 4e9ab5c48ad5153cc908dd29abad0cd2a92951e4 (fixed)

Vendor states this is fixed in 527fad1ae32ffa2d4853a1425fe1c8dbb8c9744c (fixed)

Vendor states this is fixed in 8a3734a6f4c05fd24605148f21fb2066690d61b3 (fixed)

Vendor states this is fixed in bfeede26e97ce4a15a0b961118de4a0e28c9907a (fixed)

Vendor states this is fixed in 2.6.38 (unaffected)

Vendor states this is fixed in 5.10.239 (unaffected)

Vendor states this is fixed in 5.15.186 (unaffected)

Vendor states this is fixed in 5.4.295 (unaffected)