CVE-2025-38600
BaseFortify
Publication date: 2025-08-19
Last updated on: 2025-11-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-193 | A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an off-by-one error in the Linux kernel's mt7925 wireless driver. Specifically, it occurs in the function mt7925_mcu_hw_scan() where arrays ssid->ssids[] and sreq->ssids[] have a fixed number of elements (MT7925_RNR_SCAN_MAX_BSSIDS). The code incorrectly uses a '>=' comparison instead of '>' which can lead to out-of-bounds access of these arrays.
How can this vulnerability impact me? :
The out-of-bounds access caused by this off-by-one error could potentially lead to memory corruption or unexpected behavior in the wireless driver. This might result in system instability, crashes, or could be exploited to execute arbitrary code, depending on the context and exploitability.