{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-38600",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T04:51:24.028Z",
        "datePublished": "2025-08-19T17:03:34.830Z",
        "dateUpdated": "2026-08-05T12:03:21.611Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:03:21.611Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()\n\nThe ssid->ssids[] and sreq->ssids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS\nelements so this >= needs to be > to prevent an out of bounds access."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:A - The attacker-controlled input is the Reduced Neighbor Report element carried in 802.11 beacons/probe responses, which cfg80211 parses into scan_6ghz_params and the driver copies into mdev->rnr.bssid[] before the buggy loop. This requires the attacker to transmit frames within WiFi radio range of the victim, which is the adjacent-network case.\nAC:L - The attacker fully controls the RNR contents and simply beacons ≥11 distinct colocated 6 GHz BSSIDs to push mdev->rnr.bssid_num past 10; mt7925 is a widely deployed Wi-Fi 7 chip and 6 GHz colocated scanning is the default behaviour of modern supplicants. No condition outside the attacker's influence is required.\nPR:N - The attacker needs no account or credentials on the target and need not even be associated with it — an unauthenticated rogue AP in range suffices, since the victim's own routine background scan (performed by the privileged supplicant) consumes the malicious RNR data.\nUI:N - Periodic background scanning by wpa_supplicant/NetworkManager/Android occurs automatically without any user action, so the attacker only has to keep beaconing until the next scan cycle.\nS:U - The out-of-bounds access occurs in kernel driver memory and any resulting corruption or crash is confined to the kernel's own security authority, with no crossing into a hypervisor, IOMMU, or sandbox boundary.\nC:H - The off-by-one is an out-of-bounds array/buffer write in the MCU command skb; per kernel scoring guidance memory corruption of this kind is treated as leverageable for information disclosure, and the malformed extra TLV is also handed to device firmware that parses it as trusted host data.\nI:H - An out-of-bounds write one element past a fixed-size array (36 bytes past struct scan_ssid_tlv, and a 16-byte TLV past the computed skb budget) is memory corruption, which per guidance scores High for integrity.\nA:H - Writing past the computed max_len budget via skb_put() risks exceeding the skb tail, which triggers skb_over_panic() -> BUG() and a kernel panic; the malformed over-long scan command can additionally wedge the WiFi MCU, denying connectivity."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
                    ],
                    "versions": [
                        {
                            "version": "8284815ca161e0fa0861cc4085f1c0141e10a34d",
                            "lessThan": "4d80d4fa986c5da99042b66bf30a028e7f564156",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "8284815ca161e0fa0861cc4085f1c0141e10a34d",
                            "lessThan": "b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
                    ],
                    "versions": [
                        {
                            "version": "6.16",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.16",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.16.1",
                            "lessThanOrEqual": "6.16.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.17",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.16",
                                    "versionEndExcluding": "6.16.1"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.16",
                                    "versionEndExcluding": "6.17"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/4d80d4fa986c5da99042b66bf30a028e7f564156"
                },
                {
                    "url": "https://git.kernel.org/stable/c/b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee"
                }
            ],
            "title": "wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}