{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39919", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.147Z", "datePublished": "2025-10-01T07:55:14.804Z", "dateUpdated": "2026-08-05T12:06:04.087Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:04.087Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: add missing check for rx wcid entries\n\nNon-station wcid entries must not be passed to the rx functions.\nIn case of the global wcid entry, it could even lead to corruption in the wcid\narray due to pointer being casted to struct mt7996_sta_link using container_of." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The bug is triggered purely by receiving an 802.11 frame in `mt7996_mac_fill_rx()`, so any attacker within radio range of an MT7996/MT7992/MT7990 AP can reach it. Per kernel scoring guidance, WiFi frame injection is Adjacent.\nAC:L - The attacker simply transmits broadcast/multicast or unassociated-station frames, which the hardware maps to the reserved non-station wcid entry — the exact case the removed `!wcid->sta` check used to reject. Nothing about the trigger depends on conditions outside the attacker's control, and on a tri-band device the `phy_idx != band_idx` condition for the deepest wild-pointer path is satisfied just by picking the 5 GHz or 6 GHz radio.\nPR:N - No association, authentication, or key negotiation is needed; frames from an entirely unknown device are precisely the ones that resolve to a non-station wcid. The RX path runs as soon as the interface is up (`MT76_STATE_RUNNING`).\nUI:N - The corruption happens autonomously in the driver's NAPI/RX handling of an injected frame. No victim action is involved.\nS:U - The corruption is confined to kernel memory of the same host under the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The bogus `container_of()` produces out-of-bounds reads of `msta_link->sta`, `msta->vif`, `mvif->mt76.link[i]`, and `msta->link[i]`, all landing in or beyond the `dev->wcid[]` pointer array and leaking kernel pointers. Once `dev->wcid[3..6]` are overwritten, subsequent frames use attacker-influenced pointers as `struct mt76_wcid`, giving an arbitrary-read primitive.\nI:H - `mt7996_mac_sta_poll()` writes 32+ bytes of hardware airtime-counter data through the mis-cast pointer directly over the `dev->mt76.wcid[]` RCU pointer array, and the counter values are influenceable by the attacker's own traffic. Corrupted wcid pointers are then written through on later frames (`rx_key_pn` memcpy, rssi/stats updates, list operations), yielding a controllable write primitive suitable for control-flow hijack.\nA:H - Dereferencing the wild pointers built from overwritten wcid array slots, plus list operations on garbage `poll_list`/`rc_list` heads, reliably oopses or panics the kernel. An attacker in radio range can repeat this at will, permanently downing the AP." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/mediatek/mt76/mt7996/mac.c" ], "versions": [ { "version": "7464b12b7d92b9641d4664735b9f3c3f0b6173d9", "lessThan": "69dcc19048fcdc3fb166fd25b805470ee8fc0eb1", "status": "affected", "versionType": "git" }, { "version": "7464b12b7d92b9641d4664735b9f3c3f0b6173d9", "lessThan": "4a522b01e368eec58d182ecc47d24f49a39e440d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/mediatek/mt76/mt7996/mac.c" ], "versions": [ { "version": "6.15", "status": "affected" }, { "version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.6", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.16.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/69dcc19048fcdc3fb166fd25b805470ee8fc0eb1" }, { "url": "https://git.kernel.org/stable/c/4a522b01e368eec58d182ecc47d24f49a39e440d" } ], "title": "wifi: mt76: mt7996: add missing check for rx wcid entries", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-39919", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2026-01-14T17:43:14.308348Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T17:52:48.055Z" } } ] } }