CVE-2025-38643

CVE-2025-38643 is a vulnerability in the Linux kernel's WiFi (cfg80211) component, specifically related to a missing lock in the cfg80211_check_and_end_cac() function. This oversight allows the cfg80211_propagate_cac_done_wk() worker to access wdev_chandef() without holding the necessary wiphy mutex, leading to a kernel warning. The vulnerability has a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity, requiring local privileges. The primary impact is a high availability impact, likely causing system instability or denial of service due to the kernel warning. There is no confidentiality or integrity impact. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness or attention.