CVE-2025-38157 – A vulnerability in the Linux kernel's ath9k

Q: What is the severity of CVE-2025-38157?

CVE-2025-38157 has a CVSS score of 7.8 (HIGH). A vulnerability in the Linux kernel's ath9k_htc WiFi driver allows a malicious USB device to trigger a divide-by-zero error by sending a WMI_SWBA_EVENTID event before beaconing is enabled. This can cause kernel crashes or out-of-bounds reads, potentially leading to denial of service or information disclosure. Systems using ath9k_htc-managed WiFi devices are affected.

📋 TL;DR

A vulnerability in the Linux kernel's ath9k_htc WiFi driver allows a malicious USB device to trigger a divide-by-zero error by sending a WMI_SWBA_EVENTID event before beaconing is enabled. This can cause kernel crashes or out-of-bounds reads, potentially leading to denial of service or information disclosure. Systems using ath9k_htc-managed WiFi devices are affected.

💻 Affected Systems

Products:

Linux kernel with ath9k_htc driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with ath9k_htc driver loaded (typically when using compatible Atheros USB WiFi adapters). Driver may be loaded automatically when device is connected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, potential information disclosure through out-of-bounds memory reads, or local privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System crash or instability requiring reboot, denial of service affecting WiFi functionality.

🟢

If Mitigated

No impact if the vulnerable driver is not loaded or if USB device access is restricted.

🌐 Internet-Facing: LOW - Requires physical or local USB device access, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Malicious USB devices could be plugged into vulnerable systems internally, but requires physical access or compromised USB peripherals.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Simple USB device can trigger the condition

Exploitation requires physical USB device access or ability to emulate malicious USB device. No authentication needed once device is connected.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 0281c19074976ec48f0078d50530b406ddae75bc, 40471b23147c86ea3ed97faee79937c618250bd0, 5482ef9875eaa43f0435e14570e1193823de857e, 5a85c21f812e02cb00ca07007d88acdd42d08c46, 7ee3fb6258da8c890a51b514f60d7570dc703605

Vendor Advisory: https://git.kernel.org/stable/c/0281c19074976ec48f0078d50530b406ddae75bc

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For custom kernels, apply the relevant commits from kernel.org. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Blacklist ath9k_htc driver

linux

Prevent loading of vulnerable driver module

echo 'blacklist ath9k_htc' >> /etc/modprobe.d/blacklist-ath9k.conf
update-initramfs -u
reboot

Disable automatic USB WiFi device loading

linux

Prevent automatic driver loading when USB WiFi device is connected

echo 'install ath9k_htc /bin/false' >> /etc/modprobe.d/disable-ath9k.conf
update-initramfs -u

🧯 If You Can't Patch

Restrict physical USB port access to prevent malicious device connection
Use USB device authorization policies to block unauthorized ath9k_htc devices

🔍 How to Verify

Check if Vulnerable:

Check if ath9k_htc module is loaded: lsmod | grep ath9k_htc

Check Version:

uname -r

Verify Fix Applied:

Check kernel version is patched: uname -r and verify against distribution security advisories

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
ath9k_htc driver error messages in dmesg
System crash/reboot logs

Network Indicators:

Unexpected WiFi disconnections
ath9k_htc device connection attempts

SIEM Query:

source="kernel" AND ("ath9k_htc" OR "divide by zero" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2025-38157

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

EPSS Score: 0.02% exploit probability (5.3th percentile)

Published: July 3, 2025

Last Updated: December 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38157, you might also want to check these: