CVE-2025-39761
BaseFortify
Publication date: 2025-09-11
Last updated on: 2025-11-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's ath12k wifi driver occurs because the TID (Traffic Identifier) is not decremented before peer cleanup during error handling in the function ath12k_dp_rx_peer_frag_setup(). This omission can cause out-of-bounds access in the peer->rx_tid[] array, potentially leading to improper memory access or corruption. The fix involves adding a decrement operation for TID before peer cleanup to ensure proper handling and prevent such out-of-bounds access.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory access in the wifi driver's data structures, which may cause system instability, crashes, or potentially allow an attacker to exploit the kernel memory corruption for privilege escalation or denial of service. However, the exact impact depends on the system's usage and exposure to malicious wifi traffic triggering this error path.
What immediate steps should I take to mitigate this vulnerability?
Apply the updated Linux kernel patch that includes the fix for the ath12k driver to ensure proper decrement of TID during RX peer frag setup error handling. This prevents out-of-bounds access issues. Until the patch is applied, avoid using affected ath12k wireless devices in environments where this vulnerability could be exploited.