https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:00:03 +0000 https://vulnerability.circl.lu/vuln/cve-2025-38013 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request</p> <p>Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller:</p> <p>UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type &#39;struct ieee80211_channel *[] __counted_by(n_channels)&#39; (aka &#39;struct ieee80211_channel *[]&#39;)</p> <p>This was missed in the initial conversions because I failed to locate the allocation likely due to the &#34;sizeof(void *)&#34; not matching the &#34;channels&#34; array type.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request</p> <p>Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller:</p> <p>UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type &#39;struct ieee80211_channel *[] __counted_by(n_channels)&#39; (aka &#39;struct ieee80211_channel *[]&#39;)</p> <p>This was missed in the initial conversions because I failed to locate the allocation likely due to the &#34;sizeof(void *)&#34; not matching the &#34;channels&#34; array type.</p> https://vulnerability.circl.lu/vuln/cve-2025-38013