CVE-2025-38513 wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
A race condition in the zd1211rw WiFi driver can cause a NULL pointer dereference, leading to a system crash or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38513?
CVE-2025-38513 is a medium-severity vulnerability in Debian Debian Linux, published on 16 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For example, the following is possible:
T0 T1 zd_mac_tx_to_dev() /* len == skb_queue_len(q) */ while (len > ZD_MAC_MAX_ACK_WAITERS) {
filter_ack() spin_lock_irqsave(&q->lock, flags); /* position == skb_queue_len(q) */ for (i=1; i<position; i++) skb = __skb_dequeue(q)
if (mac->type == NL80211_IFTYPE_AP) skb = __skb_dequeue(q); spin_unlock_irqrestore(&q->lock, flags);
skb_dequeue() -> NULL
Since there is a small gap between checking skb queue length and skb being unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL. Then the pointer is passed to zd_mac_tx_status() where it is dereferenced.
In order to avoid potential NULL pointer dereference due to situations like above, check if skb is not NULL before passing it to zd_mac_tx_status().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Weakness: CWE-476
Which versions are affected by CVE-2025-38513?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38513?
Apply the vendor's patch.
Is CVE-2025-38513 being exploited?
There is no known exploitation of CVE-2025-38513 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-66377, AZL-73542, BELL-CVE-2025-38513, DEBIAN-CVE-2025-38513, GHSA-h6rm-fwmf-3cqc, ROOT-OS-DEBIAN-11-CVE-2025-38513 and 4 more.