CVE-2025-39862 (GCVE-0-2025-39862)
Vulnerability from cvelistv5
Published
2025-09-19 15:26
Modified
2026-10-21 12:37
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix list corruption after hardware restart Since stations are recreated from scratch, all lists that wcids are added to must be cleared before calling ieee80211_restart_hw. Set wcid->sta = 0 for each wcid entry in order to ensure that they are not added again before they are ready.
References
Impacted products
Vendor Product Version
Linux Linux Version: 8a55712d124fd8a919e8a69b70643e1a97280b4b
Version: 8a55712d124fd8a919e8a69b70643e1a97280b4b
Version: 8a55712d124fd8a919e8a69b70643e1a97280b4b
Version: 8a55712d124fd8a919e8a69b70643e1a97280b4b
Version: 3a931ebf67b89316c3b5bed2dca4479dd6f85803
Version: 6.1.188   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:23:35.908171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:33:11.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mac80211.c",
            "drivers/net/wireless/mediatek/mt76/mt76.h",
            "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d40c15d70c2dba2f68dd50e452255bfa1b016f0",
              "status": "affected",
              "version": "8a55712d124fd8a919e8a69b70643e1a97280b4b",
              "versionType": "git"
            },
            {
              "lessThan": "6826728f9fd7e7db57cd9647932eea47cbc645c6",
              "status": "affected",
              "version": "8a55712d124fd8a919e8a69b70643e1a97280b4b",
              "versionType": "git"
            },
            {
              "lessThan": "8fa8eb52bc2eb08d93202863b5fc478e0bebc00c",
              "status": "affected",
              "version": "8a55712d124fd8a919e8a69b70643e1a97280b4b",
              "versionType": "git"
            },
            {
              "lessThan": "065c79df595af21d6d1b27d642860faa1d938774",
              "status": "affected",
              "version": "8a55712d124fd8a919e8a69b70643e1a97280b4b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a931ebf67b89316c3b5bed2dca4479dd6f85803",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.188",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mac80211.c",
            "drivers/net/wireless/mediatek/mt76/mt76.h",
            "drivers/net/wireless/mediatek/mt76/mt7915/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.188",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix list corruption after hardware restart\n\nSince stations are recreated from scratch, all lists that wcids are added\nto must be cleared before calling ieee80211_restart_hw.\nSet wcid-\u003esta = 0 for each wcid entry in order to ensure that they are\nnot added again before they are ready."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The mt7915 driver is an 802.11 device driver whose reset path is armed by firmware watchdog exceptions and MCU command timeouts driven by received wireless traffic, and the corrupted lists are then exercised by the RX/TX paths for frames from stations in radio range. Per kernel scoring guidance WiFi driver bugs reachable by frame injection are Adjacent.\nAC:L - The attacker generates every required condition with their own traffic \u2014 flooding auth/assoc requests and malformed management frames to force the firmware exception or MCU timeout that queues the full reset, and associating/deauthing stations to control which wcids remain on the stale lists and which sta slabs are freed and reallocated. Nothing depends on state outside the attacker\u0027s influence.\nPR:N - No credentials on the target are required; unassociated frame injection (probe/auth/assoc floods, deauth) is sufficient to both trigger the reset and populate the stale wcid entries, and an attacker on an open or guest WLAN holds no privilege on the AP.\nUI:N - The corruption happens autonomously inside the driver\u0027s reset work, mac80211 reconfig and tx worker in response to attacker-generated frames. No administrator or local user action is involved.\nS:U - The corrupted list heads, stale RCU pointers and resulting writes are all confined to kernel memory under the kernel\u0027s own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - Dangling `dev-\u003ewcid[]` entries surviving the reset are dereferenced by the RX and TX-status fastpaths after mac80211 frees the backing `ieee80211_sta` objects, giving out-of-bounds and use-after-free reads of attacker-groomable slab memory, and the traversal of `dev-\u003ewcid_list`/`phy-\u003etx_list` leaks kernel pointers. Per the use-after-free guidance this rates High.\nI:H - `list_add_tail()`/`list_del_init()` on the reinitialized-but-still-linked nodes write kernel pointers into freed and reallocated station objects (`prev-\u003enext`, `next-\u003eprev`), and the RX path writes through stale wcid pointers (`rx_key_pn` memcpy, RSSI/stat updates, poll-list insertion) \u2014 a controllable kernel write primitive suitable for control-flow hijacking.\nA:H - List corruption plus dereference of dangling wcid pointers reliably oopses or panics the kernel; with CONFIG_DEBUG_LIST it is an immediate list-corruption BUG, and the cross-linked heads can spin `mt76_txq_schedule_pending()`\u0027s `while (!list_empty(\u0026tx_list))` forever with `phy-\u003etx_lock` held and BHs disabled, hanging the AP."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:37:30.520Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6d40c15d70c2dba2f68dd50e452255bfa1b016f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6826728f9fd7e7db57cd9647932eea47cbc645c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fa8eb52bc2eb08d93202863b5fc478e0bebc00c"
        },
        {
          "url": "https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774"
        }
      ],
      "title": "wifi: mt76: mt7915: fix list corruption after hardware restart",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39862",
    "datePublished": "2025-09-19T15:26:32.259Z",
    "dateReserved": "2025-04-16T07:20:57.143Z",
    "dateUpdated": "2026-10-21T12:37:30.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39862\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:23:35.908171Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T19:23:30.354Z\"}}], \"cna\": {\"title\": \"wifi: mt76: mt7915: fix list corruption after hardware restart\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The mt7915 driver is an 802.11 device driver whose reset path is armed by firmware watchdog exceptions and MCU command timeouts driven by received wireless traffic, and the corrupted lists are then exercised by the RX/TX paths for frames from stations in radio range. Per kernel scoring guidance WiFi driver bugs reachable by frame injection are Adjacent.\\nAC:L - The attacker generates every required condition with their own traffic \\u2014 flooding auth/assoc requests and malformed management frames to force the firmware exception or MCU timeout that queues the full reset, and associating/deauthing stations to control which wcids remain on the stale lists and which sta slabs are freed and reallocated. Nothing depends on state outside the attacker\u0027s influence.\\nPR:N - No credentials on the target are required; unassociated frame injection (probe/auth/assoc floods, deauth) is sufficient to both trigger the reset and populate the stale wcid entries, and an attacker on an open or guest WLAN holds no privilege on the AP.\\nUI:N - The corruption happens autonomously inside the driver\u0027s reset work, mac80211 reconfig and tx worker in response to attacker-generated frames. No administrator or local user action is involved.\\nS:U - The corrupted list heads, stale RCU pointers and resulting writes are all confined to kernel memory under the kernel\u0027s own security authority. No VM, IOMMU or sandbox boundary is crossed.\\nC:H - Dangling `dev-\u003ewcid[]` entries surviving the reset are dereferenced by the RX and TX-status fastpaths after mac80211 frees the backing `ieee80211_sta` objects, giving out-of-bounds and use-after-free reads of attacker-groomable slab memory, and the traversal of `dev-\u003ewcid_list`/`phy-\u003etx_list` leaks kernel pointers. Per the use-after-free guidance this rates High.\\nI:H - `list_add_tail()`/`list_del_init()` on the reinitialized-but-still-linked nodes write kernel pointers into freed and reallocated station objects (`prev-\u003enext`, `next-\u003eprev`), and the RX path writes through stale wcid pointers (`rx_key_pn` memcpy, RSSI/stat updates, poll-list insertion) \\u2014 a controllable kernel write primitive suitable for control-flow hijacking.\\nA:H - List corruption plus dereference of dangling wcid pointers reliably oopses or panics the kernel; with CONFIG_DEBUG_LIST it is an immediate list-corruption BUG, and the cross-linked heads can spin `mt76_txq_schedule_pending()`\u0027s `while (!list_empty(\u0026tx_list))` forever with `phy-\u003etx_lock` held and BHs disabled, hanging the AP.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8a55712d124fd8a919e8a69b70643e1a97280b4b\", \"lessThan\": \"6d40c15d70c2dba2f68dd50e452255bfa1b016f0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8a55712d124fd8a919e8a69b70643e1a97280b4b\", \"lessThan\": \"6826728f9fd7e7db57cd9647932eea47cbc645c6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8a55712d124fd8a919e8a69b70643e1a97280b4b\", \"lessThan\": \"8fa8eb52bc2eb08d93202863b5fc478e0bebc00c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8a55712d124fd8a919e8a69b70643e1a97280b4b\", \"lessThan\": \"065c79df595af21d6d1b27d642860faa1d938774\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3a931ebf67b89316c3b5bed2dca4479dd6f85803\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.1.188\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/wireless/mediatek/mt76/mac80211.c\", \"drivers/net/wireless/mediatek/mt76/mt76.h\", \"drivers/net/wireless/mediatek/mt76/mt7915/mac.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.114\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/mediatek/mt76/mac80211.c\", \"drivers/net/wireless/mediatek/mt76/mt76.h\", \"drivers/net/wireless/mediatek/mt76/mt7915/mac.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6d40c15d70c2dba2f68dd50e452255bfa1b016f0\"}, {\"url\": \"https://git.kernel.org/stable/c/6826728f9fd7e7db57cd9647932eea47cbc645c6\"}, {\"url\": \"https://git.kernel.org/stable/c/8fa8eb52bc2eb08d93202863b5fc478e0bebc00c\"}, {\"url\": \"https://git.kernel.org/stable/c/065c79df595af21d6d1b27d642860faa1d938774\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7915: fix list corruption after hardware restart\\n\\nSince stations are recreated from scratch, all lists that wcids are added\\nto must be cleared before calling ieee80211_restart_hw.\\nSet wcid-\u003esta = 0 for each wcid entry in order to ensure that they are\\nnot added again before they are ready.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.160\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.114\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.6\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.1.188\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-21T12:37:30.520Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39862\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-21T12:37:30.520Z\", \"dateReserved\": \"2025-04-16T07:20:57.143Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-19T15:26:32.259Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.