{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39862", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.143Z", "datePublished": "2025-09-19T15:26:32.259Z", "dateUpdated": "2026-08-05T12:05:42.373Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:42.373Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix list corruption after hardware restart\n\nSince stations are recreated from scratch, all lists that wcids are added\nto must be cleared before calling ieee80211_restart_hw.\nSet wcid->sta = 0 for each wcid entry in order to ensure that they are\nnot added again before they are ready." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The mt7915 driver is an 802.11 device driver whose reset path is armed by firmware watchdog exceptions and MCU command timeouts driven by received wireless traffic, and the corrupted lists are then exercised by the RX/TX paths for frames from stations in radio range. Per kernel scoring guidance WiFi driver bugs reachable by frame injection are Adjacent.\nAC:L - The attacker generates every required condition with their own traffic — flooding auth/assoc requests and malformed management frames to force the firmware exception or MCU timeout that queues the full reset, and associating/deauthing stations to control which wcids remain on the stale lists and which sta slabs are freed and reallocated. Nothing depends on state outside the attacker's influence.\nPR:N - No credentials on the target are required; unassociated frame injection (probe/auth/assoc floods, deauth) is sufficient to both trigger the reset and populate the stale wcid entries, and an attacker on an open or guest WLAN holds no privilege on the AP.\nUI:N - The corruption happens autonomously inside the driver's reset work, mac80211 reconfig and tx worker in response to attacker-generated frames. No administrator or local user action is involved.\nS:U - The corrupted list heads, stale RCU pointers and resulting writes are all confined to kernel memory under the kernel's own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - Dangling `dev->wcid[]` entries surviving the reset are dereferenced by the RX and TX-status fastpaths after mac80211 frees the backing `ieee80211_sta` objects, giving out-of-bounds and use-after-free reads of attacker-groomable slab memory, and the traversal of `dev->wcid_list`/`phy->tx_list` leaks kernel pointers. Per the use-after-free guidance this rates High.\nI:H - `list_add_tail()`/`list_del_init()` on the reinitialized-but-still-linked nodes write kernel pointers into freed and reallocated station objects (`prev->next`, `next->prev`), and the RX path writes through stale wcid pointers (`rx_key_pn` memcpy, RSSI/stat updates, poll-list insertion) — a controllable kernel write primitive suitable for control-flow hijacking.\nA:H - List corruption plus dereference of dangling wcid pointers reliably oopses or panics the kernel; with CONFIG_DEBUG_LIST it is an immediate list-corruption BUG, and the cross-linked heads can spin `mt76_txq_schedule_pending()`'s `while (!list_empty(&tx_list))` forever with `phy->tx_lock` held and BHs disabled, hanging the AP." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/mediatek/mt76/mac80211.c", "drivers/net/wireless/mediatek/mt76/mt76.h", "drivers/net/wireless/mediatek/mt76/mt7915/mac.c" ], "versions": [ { "version": "8a55712d124fd8a919e8a69b70643e1a97280b4b", "lessThan": "8fa8eb52bc2eb08d93202863b5fc478e0bebc00c", "status": "affected", "versionType": "git" }, { "version": "8a55712d124fd8a919e8a69b70643e1a97280b4b", "lessThan": "065c79df595af21d6d1b27d642860faa1d938774", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/mediatek/mt76/mac80211.c", "drivers/net/wireless/mediatek/mt76/mt76.h", "drivers/net/wireless/mediatek/mt76/mt7915/mac.c" ], "versions": [ { "version": "6.2", "status": "affected" }, { "version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.6", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.16.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8fa8eb52bc2eb08d93202863b5fc478e0bebc00c" }, { "url": "https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774" } ], "title": "wifi: mt76: mt7915: fix list corruption after hardware restart", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-39862", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-01-14T19:23:35.908171Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:33:11.429Z" } } ] } }