CVE-2025-37796

Published: May 1, 2025Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x: fix use after free access in at76_disconnect The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface.

Affected (13)

Products: Linux: Linux Kernel

1 product

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	3.17.1 ≤ version < 5.4.293
Linux Linux Kernel	5.11 ≤ version < 5.15.181
Linux Linux Kernel	5.16 ≤ version < 6.1.135
Linux Linux Kernel	5.5 ≤ version < 5.10.237
Linux Linux Kernel	6.13 ≤ version < 6.14.4
Linux Linux Kernel	6.2 ≤ version < 6.6.88
Linux Linux Kernel	6.7 ≤ version < 6.12.25
Linux Linux Kernel	Version 3.17
Linux Linux Kernel	Version 3.17 rc5
Linux Linux Kernel	Version 3.17 rc6
Linux Linux Kernel	Version 3.17 rc7
Linux Linux Kernel	Version 6.15 rc1
Linux Linux Kernel	Version 6.15 rc2

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (10)

https://git.kernel.org/stable/c/152721cbae42713ecfbca6847e0f102ee6b19546

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/3c619aec1f538333b56746d2f796aab1bca5c9a5

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/5e7df74745700f059dc117a620e566964a2e8f2c

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/7ca513631fa6ad3011b8b9197cdde0f351103704

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/a9682bfef2cf3802515a902e964d774e137be1b9

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://git.kernel.org/stable/c/c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.