CVE-2025-37796 (GCVE-0-2025-37796)
Vulnerability from cvelistv5
Published
2025-05-01 13:07
Modified
2025-05-26 05:21
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x: fix use after free access in at76_disconnect The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface.
Impacted products
Vendor Product Version
Linux Linux Version: 29e20aa6c6aff35c81d4da2e2cd516dadb569061
Version: 29e20aa6c6aff35c81d4da2e2cd516dadb569061
Version: 29e20aa6c6aff35c81d4da2e2cd516dadb569061
Version: 29e20aa6c6aff35c81d4da2e2cd516dadb569061
Version: 29e20aa6c6aff35c81d4da2e2cd516dadb569061
Version: 29e20aa6c6aff35c81d4da2e2cd516dadb569061
Version: 29e20aa6c6aff35c81d4da2e2cd516dadb569061
Version: 29e20aa6c6aff35c81d4da2e2cd516dadb569061
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/atmel/at76c50x-usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6",
              "status": "affected",
              "version": "29e20aa6c6aff35c81d4da2e2cd516dadb569061",
              "versionType": "git"
            },
            {
              "lessThan": "6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f",
              "status": "affected",
              "version": "29e20aa6c6aff35c81d4da2e2cd516dadb569061",
              "versionType": "git"
            },
            {
              "lessThan": "3c619aec1f538333b56746d2f796aab1bca5c9a5",
              "status": "affected",
              "version": "29e20aa6c6aff35c81d4da2e2cd516dadb569061",
              "versionType": "git"
            },
            {
              "lessThan": "5e7df74745700f059dc117a620e566964a2e8f2c",
              "status": "affected",
              "version": "29e20aa6c6aff35c81d4da2e2cd516dadb569061",
              "versionType": "git"
            },
            {
              "lessThan": "7ca513631fa6ad3011b8b9197cdde0f351103704",
              "status": "affected",
              "version": "29e20aa6c6aff35c81d4da2e2cd516dadb569061",
              "versionType": "git"
            },
            {
              "lessThan": "a9682bfef2cf3802515a902e964d774e137be1b9",
              "status": "affected",
              "version": "29e20aa6c6aff35c81d4da2e2cd516dadb569061",
              "versionType": "git"
            },
            {
              "lessThan": "152721cbae42713ecfbca6847e0f102ee6b19546",
              "status": "affected",
              "version": "29e20aa6c6aff35c81d4da2e2cd516dadb569061",
              "versionType": "git"
            },
            {
              "lessThan": "27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da",
              "status": "affected",
              "version": "29e20aa6c6aff35c81d4da2e2cd516dadb569061",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/atmel/at76c50x-usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.293",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.135",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.88",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.25",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.4",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: at76c50x: fix use after free access in at76_disconnect\n\nThe memory pointed to by priv is freed at the end of at76_delete_device\nfunction (using ieee80211_free_hw). But the code then accesses the udev\nfield of the freed object to put the USB device. This may also lead to a\nmemory leak of the usb device. Fix this by using udev from interface."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:21:03.759Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c619aec1f538333b56746d2f796aab1bca5c9a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e7df74745700f059dc117a620e566964a2e8f2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ca513631fa6ad3011b8b9197cdde0f351103704"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9682bfef2cf3802515a902e964d774e137be1b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/152721cbae42713ecfbca6847e0f102ee6b19546"
        },
        {
          "url": "https://git.kernel.org/stable/c/27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da"
        }
      ],
      "title": "wifi: at76c50x: fix use after free access in at76_disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37796",
    "datePublished": "2025-05-01T13:07:27.694Z",
    "dateReserved": "2025-04-16T04:51:23.941Z",
    "dateUpdated": "2025-05-26T05:21:03.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37796\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T14:15:44.173\",\"lastModified\":\"2025-05-02T13:53:20.943\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: at76c50x: fix use after free access in at76_disconnect\\n\\nThe memory pointed to by priv is freed at the end of at76_delete_device\\nfunction (using ieee80211_free_hw). But the code then accesses the udev\\nfield of the freed object to put the USB device. This may also lead to a\\nmemory leak of the usb device. Fix this by using udev from interface.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: at76c50x: se corrige el use after free en at76_disconnect. La memoria a la que apunta priv se libera al final de la funci\u00f3n at76_delete_device (mediante ieee80211_free_hw). Sin embargo, el c\u00f3digo accede al campo udev del objeto liberado para colocar el dispositivo USB. Esto tambi\u00e9n puede provocar una fuga de memoria del dispositivo USB. Se soluciona usando udev desde la interfaz.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/152721cbae42713ecfbca6847e0f102ee6b19546\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3c619aec1f538333b56746d2f796aab1bca5c9a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e7df74745700f059dc117a620e566964a2e8f2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7ca513631fa6ad3011b8b9197cdde0f351103704\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a9682bfef2cf3802515a902e964d774e137be1b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…