CVE-2025-38602

iwlwifi: Add missing check for alloc_ordered_workqueue

MEDIUM

5.5

CVSS Score

Published: August 19, 2025 at 05:03 PM UTC

Updated: June 17, 2026 at 09:17 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

2.6.24 ≤ v < 5.10.2412.6.24 ≤ v < 5.15.1902.6.24 ≤ v < 5.4.2972.6.24 ≤ v < 6.1.1482.6.24 ≤ v < 6.12.422.6.24 ≤ v < 6.15.102.6.24 ≤ v < 6.16.12.6.24 ≤ v < 6.172.6.24 ≤ v < 6.6.1025.11 ≤ v < 5.15.1905.16 ≤ v < 6.1.1485.5 ≤ v < 5.10.2416.13 ≤ v < 6.15.106.16 ≤ v < 6.16.16.2 ≤ v < 6.6.1026.7 ≤ v < 6.12.422.6.24b481de9ca074528fe8c429604e2777db8b89806a

Vendor states this is fixed in 2e9f85ee3b46453a2f250a57d3a9f10c70c71202 (fixed)

Vendor states this is fixed in 6663c52608d8d8727bf1911e6d9218069ba1c85e (fixed)

Vendor states this is fixed in 70a1b527eaea9430b1bd87de59f3b9f6bd225701 (fixed)

Vendor states this is fixed in 7dd6350307af6521b6240b295c93b7eec4daebe6 (fixed)

Vendor states this is fixed in 90a0d9f339960448a3acc1437a46730f975efd6a (fixed)

Vendor states this is fixed in b398120fbe0acfef60b16f6a0f69902d385d7728 (fixed)

Vendor states this is fixed in c0e43c3f6c0a79381b468574c241065998412b7c (fixed)

Vendor states this is fixed in c80832d445653baba5ac80cd2c2637c437ac881b (fixed)

Vendor states this is fixed in ca980f1911a7144d451d1c31298ab8507c6bd88f (fixed)

Vendor states this is fixed in 2.6.24 (unaffected)

Vendor states this is fixed in 5.10.241 (unaffected)

Vendor states this is fixed in 5.15.190 (unaffected)