CVE-2025-38512 (GCVE-0-2025-38512)

Vulnerability from cvelistv5 – Published: 2025-08-16 10:54 – Updated: 2026-08-05 12:02
VLAI
Title
wifi: prevent A-MSDU attacks in mesh networks
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 but for mesh networks. This patch tries to detect if a standard MSDU was turned into an A-MSDU by an adversary. This is done by parsing a received A-MSDU as a standard MSDU, calculating the length of the Mesh Control header, and seeing if the 6 bytes after this header equal the start of an rfc1042 header. If equal, this is a strong indication of an ongoing attack attempt. This defense was tested with mac80211_hwsim against a mesh network that uses an empty Mesh Address Extension field, i.e., when four addresses are used, and when using a 12-byte Mesh Address Extension field, i.e., when six addresses are used. Functionality of normal MSDUs and A-MSDUs was also tested, and confirmed working, when using both an empty and 12-byte Mesh Address Extension field. It was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh networks keep being detected and prevented. Note that the vulnerability being patched, and the defense being implemented, was also discussed in the following paper and in the following IEEE 802.11 presentation: https://papers.mathyvanhoef.com/wisec2025.pdf https://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 79720743421753ff72bfa0d79976c534645b81c1 , < e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80 (git)
Affected: 986e43b19ae9176093da35e0a844e65c8bf9ede7 , < ec6392061de6681148b63ee6c8744da833498cdd (git)
Affected: 986e43b19ae9176093da35e0a844e65c8bf9ede7 , < e01851f6e9a665a6011b14714b271d3e6b0b8d32 (git)
Affected: 986e43b19ae9176093da35e0a844e65c8bf9ede7 , < 6e3b09402cc6c3e3474fa548e8adf6897dda05de (git)
Affected: 986e43b19ae9176093da35e0a844e65c8bf9ede7 , < 737bb912ebbe4571195c56eba557c4d7315b26fb (git)
Affected: 6.1.107 , < 6.1.146 (semver)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.1.146 , ≤ 6.1.* (semver)
Unaffected: 6.6.99 , ≤ 6.6.* (semver)
Unaffected: 6.12.39 , ≤ 6.12.* (semver)
Unaffected: 6.15.7 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:14.400Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80",
              "status": "affected",
              "version": "79720743421753ff72bfa0d79976c534645b81c1",
              "versionType": "git"
            },
            {
              "lessThan": "ec6392061de6681148b63ee6c8744da833498cdd",
              "status": "affected",
              "version": "986e43b19ae9176093da35e0a844e65c8bf9ede7",
              "versionType": "git"
            },
            {
              "lessThan": "e01851f6e9a665a6011b14714b271d3e6b0b8d32",
              "status": "affected",
              "version": "986e43b19ae9176093da35e0a844e65c8bf9ede7",
              "versionType": "git"
            },
            {
              "lessThan": "6e3b09402cc6c3e3474fa548e8adf6897dda05de",
              "status": "affected",
              "version": "986e43b19ae9176093da35e0a844e65c8bf9ede7",
              "versionType": "git"
            },
            {
              "lessThan": "737bb912ebbe4571195c56eba557c4d7315b26fb",
              "status": "affected",
              "version": "986e43b19ae9176093da35e0a844e65c8bf9ede7",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.146",
              "status": "affected",
              "version": "6.1.107",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "6.1.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: prevent A-MSDU attacks in mesh networks\n\nThis patch is a mitigation to prevent the A-MSDU spoofing vulnerability\nfor mesh networks. The initial update to the IEEE 802.11 standard, in\nresponse to the FragAttacks, missed this case (CVE-2025-27558). It can\nbe considered a variant of CVE-2020-24588 but for mesh networks.\n\nThis patch tries to detect if a standard MSDU was turned into an A-MSDU\nby an adversary. This is done by parsing a received A-MSDU as a standard\nMSDU, calculating the length of the Mesh Control header, and seeing if\nthe 6 bytes after this header equal the start of an rfc1042 header. If\nequal, this is a strong indication of an ongoing attack attempt.\n\nThis defense was tested with mac80211_hwsim against a mesh network that\nuses an empty Mesh Address Extension field, i.e., when four addresses\nare used, and when using a 12-byte Mesh Address Extension field, i.e.,\nwhen six addresses are used. Functionality of normal MSDUs and A-MSDUs\nwas also tested, and confirmed working, when using both an empty and\n12-byte Mesh Address Extension field.\n\nIt was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh\nnetworks keep being detected and prevented.\n\nNote that the vulnerability being patched, and the defense being\nimplemented, was also discussed in the following paper and in the\nfollowing IEEE 802.11 presentation:\n\nhttps://papers.mathyvanhoef.com/wisec2025.pdf\nhttps://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Exploitation requires the attacker to capture and re-inject 802.11 frames within radio range of the target mesh network, flipping the unauthenticated A-MSDU-Present bit in the QoS Control field. This is Wi-Fi frame injection on the same wireless segment, which maps to Adjacent.\nAC:L - The attacker controls every precondition: a monitor-mode radio, a standard channel-based MitM to relay the frame (as in KRACK/FragAttacks tooling), and causing known plaintext to traverse the link by simply sending traffic toward the victim; the parsing outcome is deterministic once the bit is flipped. 802.11s mesh is a mainstream deployment (OpenWrt/IoT/smart-home routers) and SPP A-MSDU protection is essentially never negotiated in practice.\nPR:N - The attacker holds no credentials on the mesh network \u2014 the frame is legitimately encrypted and MIC-validated by an authenticated peer, and only an unprotected header bit outside the cryptographic integrity check is modified. No authentication or authorization is required at any point on the path.\nUI:N - No victim action is needed; the attacker can elicit the required frame by sending unsolicited traffic toward the victim or by acting on routinely present mesh/broadcast traffic. Parsing happens automatically in the receive path.\nS:U - The injected frames are processed and forwarded by the same kernel networking stack that contains the flaw, which is that component\u0027s normal authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - Bypassing the link-layer integrity guarantee lets an unauthenticated attacker inject frames that poison the mesh proxy path table (`mpp_path_add()`), redirecting traffic destined for arbitrary addresses to a node of the attacker\u0027s choosing, and enables the documented FragAttacks chain (spoofed router advertisement/DNS) to intercept the victim\u0027s entire traffic stream. Data that WPA2/WPA3 is supposed to protect becomes readable by the attacker.\nI:H - The attacker gains arbitrary Ethernet/IP packet injection into a cryptographically protected mesh, with the frames attributed to a legitimately authenticated peer and forwarded across the whole mesh and out its gateway. Attacker-controlled Mesh Control headers additionally allow rewriting the node\u0027s mesh proxy/routing state, a complete loss of integrity for traffic handled by the interface.\nA:H - Persistently poisoning the mesh proxy path table lets the attacker blackhole traffic for arbitrary destinations, including the mesh gateway, cutting off forwarding for the affected node and downstream clients; injected frames can also tear down connections at will. For a mesh router whose function is forwarding, this is a total loss of the affected service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:33.752Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec6392061de6681148b63ee6c8744da833498cdd"
        },
        {
          "url": "https://git.kernel.org/stable/c/e01851f6e9a665a6011b14714b271d3e6b0b8d32"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e3b09402cc6c3e3474fa548e8adf6897dda05de"
        },
        {
          "url": "https://git.kernel.org/stable/c/737bb912ebbe4571195c56eba557c4d7315b26fb"
        }
      ],
      "title": "wifi: prevent A-MSDU attacks in mesh networks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38512",
    "datePublished": "2025-08-16T10:54:54.285Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:33.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38512",
      "date": "2026-08-05",
      "epss": "0.00222",
      "percentile": "0.12757"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-04T01:45:38.000Z",
      "cve": "CVE-2025-38512",
      "id": "msrc_CVE-2025-38512",
      "initial_release_date": "2025-08-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: prevent A-MSDU attacks in mesh networks",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38512.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38512\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-16T11:15:44.263\",\"lastModified\":\"2026-07-30T06:23:23.413\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: prevent A-MSDU attacks in mesh networks\\n\\nThis patch is a mitigation to prevent the A-MSDU spoofing vulnerability\\nfor mesh networks. The initial update to the IEEE 802.11 standard, in\\nresponse to the FragAttacks, missed this case (CVE-2025-27558). It can\\nbe considered a variant of CVE-2020-24588 but for mesh networks.\\n\\nThis patch tries to detect if a standard MSDU was turned into an A-MSDU\\nby an adversary. This is done by parsing a received A-MSDU as a standard\\nMSDU, calculating the length of the Mesh Control header, and seeing if\\nthe 6 bytes after this header equal the start of an rfc1042 header. If\\nequal, this is a strong indication of an ongoing attack attempt.\\n\\nThis defense was tested with mac80211_hwsim against a mesh network that\\nuses an empty Mesh Address Extension field, i.e., when four addresses\\nare used, and when using a 12-byte Mesh Address Extension field, i.e.,\\nwhen six addresses are used. Functionality of normal MSDUs and A-MSDUs\\nwas also tested, and confirmed working, when using both an empty and\\n12-byte Mesh Address Extension field.\\n\\nIt was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh\\nnetworks keep being detected and prevented.\\n\\nNote that the vulnerability being patched, and the defense being\\nimplemented, was also discussed in the following paper and in the\\nfollowing IEEE 802.11 presentation:\\n\\nhttps://papers.mathyvanhoef.com/wisec2025.pdf\\nhttps://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: prevenir ataques A-MSDU en redes de malla Este parche es una mitigaci\u00f3n para prevenir la vulnerabilidad de suplantaci\u00f3n de A-MSDU para redes de malla. La actualizaci\u00f3n inicial del est\u00e1ndar IEEE 802.11, en respuesta a los FragAttacks, pas\u00f3 por alto este caso (CVE-2025-27558). Puede considerarse una variante de CVE-2020-24588 pero para redes de malla. Este parche intenta detectar si un adversario convirti\u00f3 una MSDU est\u00e1ndar en una A-MSDU. Esto se hace analizando una A-MSDU recibida como una MSDU est\u00e1ndar, calculando la longitud del encabezado Mesh Control y viendo si los 6 bytes despu\u00e9s de este encabezado equivalen al comienzo de un encabezado rfc1042. Si son iguales, esto es un fuerte indicio de un intento de ataque en curso. Esta defensa se prob\u00f3 con mac80211_hwsim contra una red en malla que utiliza un campo de extensi\u00f3n de direcci\u00f3n de malla vac\u00edo (es decir, cuando se utilizan cuatro direcciones) y un campo de extensi\u00f3n de direcci\u00f3n de malla de 12 bytes (es decir, cuando se utilizan seis direcciones). Tambi\u00e9n se prob\u00f3 la funcionalidad de las MSDU normales y las A-MSDU, y se confirm\u00f3 su funcionamiento, tanto al utilizar un campo de extensi\u00f3n de direcci\u00f3n de malla vac\u00edo como al utilizar un campo de extensi\u00f3n de direcci\u00f3n de malla de 12 bytes. Tambi\u00e9n se prob\u00f3 con mac80211_hwsim que los ataques A-MSDU en redes no en malla se siguen detectando y previniendo. Tenga en cuenta que la vulnerabilidad que se est\u00e1 reparando y la defensa que se est\u00e1 implementando tambi\u00e9n se analizaron en el siguiente documento y en la siguiente presentaci\u00f3n IEEE 802.11: https://papers.mathyvanhoef.com/wisec2025.pdf https://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/wireless/util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"79720743421753ff72bfa0d79976c534645b81c1\",\"lessThan\":\"e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"986e43b19ae9176093da35e0a844e65c8bf9ede7\",\"lessThan\":\"ec6392061de6681148b63ee6c8744da833498cdd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"986e43b19ae9176093da35e0a844e65c8bf9ede7\",\"lessThan\":\"e01851f6e9a665a6011b14714b271d3e6b0b8d32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"986e43b19ae9176093da35e0a844e65c8bf9ede7\",\"lessThan\":\"6e3b09402cc6c3e3474fa548e8adf6897dda05de\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"986e43b19ae9176093da35e0a844e65c8bf9ede7\",\"lessThan\":\"737bb912ebbe4571195c56eba557c4d7315b26fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.107\",\"lessThan\":\"6.1.146\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/wireless/util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.146\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.99\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.39\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.7\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.107\",\"versionEndExcluding\":\"6.1.146\",\"matchCriteriaId\":\"3D14FEB8-69F7-49AF-87A9-F2BDBD813D90\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.99\",\"matchCriteriaId\":\"E813B7AA-B949-4141-A30B-900DE2459697\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.39\",\"matchCriteriaId\":\"18D57670-11F8-4B5A-AD56-EA32DD0F44E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.7\",\"matchCriteriaId\":\"F9C46937-5FA9-4335-AD7B-E7FC29453CE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6e3b09402cc6c3e3474fa548e8adf6897dda05de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/737bb912ebbe4571195c56eba557c4d7315b26fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e01851f6e9a665a6011b14714b271d3e6b0b8d32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec6392061de6681148b63ee6c8744da833498cdd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:03:33+00:00",
      "cve": "CVE-2025-38512",
      "id": "CVE-2025-38512",
      "initial_release_date": "2025-08-16T00:00:00+00:00",
      "product_status:known_affected": "196",
      "product_status:known_not_affected": "78",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: prevent A-MSDU attacks in mesh networks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38512.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-16T18:40:01Z",
      "cve": "CVE-2025-38512",
      "id": "CVE-2025-38512",
      "initial_release_date": "2025-08-16T23:23:02Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "623",
      "product_status:known_not_affected": "91",
      "product_status:recommended": "556",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38512",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38512.json",
      "version": "38"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.