CVE-2025-39919 (GCVE-0-2025-39919)

Vulnerability from cvelistv5 – Published: 2025-10-01 07:55 – Updated: 2026-08-05 12:06
VLAI
Title
wifi: mt76: mt7996: add missing check for rx wcid entries
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: add missing check for rx wcid entries Non-station wcid entries must not be passed to the rx functions. In case of the global wcid entry, it could even lead to corruption in the wcid array due to pointer being casted to struct mt7996_sta_link using container_of.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7464b12b7d92b9641d4664735b9f3c3f0b6173d9 , < 69dcc19048fcdc3fb166fd25b805470ee8fc0eb1 (git)
Affected: 7464b12b7d92b9641d4664735b9f3c3f0b6173d9 , < 4a522b01e368eec58d182ecc47d24f49a39e440d (git)
Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.16.6 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39919",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T17:43:14.308348Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T17:52:48.055Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69dcc19048fcdc3fb166fd25b805470ee8fc0eb1",
              "status": "affected",
              "version": "7464b12b7d92b9641d4664735b9f3c3f0b6173d9",
              "versionType": "git"
            },
            {
              "lessThan": "4a522b01e368eec58d182ecc47d24f49a39e440d",
              "status": "affected",
              "version": "7464b12b7d92b9641d4664735b9f3c3f0b6173d9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: add missing check for rx wcid entries\n\nNon-station wcid entries must not be passed to the rx functions.\nIn case of the global wcid entry, it could even lead to corruption in the wcid\narray due to pointer being casted to struct mt7996_sta_link using container_of."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is triggered purely by receiving an 802.11 frame in `mt7996_mac_fill_rx()`, so any attacker within radio range of an MT7996/MT7992/MT7990 AP can reach it. Per kernel scoring guidance, WiFi frame injection is Adjacent.\nAC:L - The attacker simply transmits broadcast/multicast or unassociated-station frames, which the hardware maps to the reserved non-station wcid entry \u2014 the exact case the removed `!wcid-\u003esta` check used to reject. Nothing about the trigger depends on conditions outside the attacker\u0027s control, and on a tri-band device the `phy_idx != band_idx` condition for the deepest wild-pointer path is satisfied just by picking the 5 GHz or 6 GHz radio.\nPR:N - No association, authentication, or key negotiation is needed; frames from an entirely unknown device are precisely the ones that resolve to a non-station wcid. The RX path runs as soon as the interface is up (`MT76_STATE_RUNNING`).\nUI:N - The corruption happens autonomously in the driver\u0027s NAPI/RX handling of an injected frame. No victim action is involved.\nS:U - The corruption is confined to kernel memory of the same host under the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The bogus `container_of()` produces out-of-bounds reads of `msta_link-\u003esta`, `msta-\u003evif`, `mvif-\u003emt76.link[i]`, and `msta-\u003elink[i]`, all landing in or beyond the `dev-\u003ewcid[]` pointer array and leaking kernel pointers. Once `dev-\u003ewcid[3..6]` are overwritten, subsequent frames use attacker-influenced pointers as `struct mt76_wcid`, giving an arbitrary-read primitive.\nI:H - `mt7996_mac_sta_poll()` writes 32+ bytes of hardware airtime-counter data through the mis-cast pointer directly over the `dev-\u003emt76.wcid[]` RCU pointer array, and the counter values are influenceable by the attacker\u0027s own traffic. Corrupted wcid pointers are then written through on later frames (`rx_key_pn` memcpy, rssi/stats updates, list operations), yielding a controllable write primitive suitable for control-flow hijack.\nA:H - Dereferencing the wild pointers built from overwritten wcid array slots, plus list operations on garbage `poll_list`/`rc_list` heads, reliably oopses or panics the kernel. An attacker in radio range can repeat this at will, permanently downing the AP."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:04.087Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69dcc19048fcdc3fb166fd25b805470ee8fc0eb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a522b01e368eec58d182ecc47d24f49a39e440d"
        }
      ],
      "title": "wifi: mt76: mt7996: add missing check for rx wcid entries",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39919",
    "datePublished": "2025-10-01T07:55:14.804Z",
    "dateReserved": "2025-04-16T07:20:57.147Z",
    "dateUpdated": "2026-08-05T12:06:04.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39919",
      "date": "2026-08-10",
      "epss": "0.00166",
      "percentile": "0.06246"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39919\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T08:15:35.120\",\"lastModified\":\"2026-07-30T06:23:56.227\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7996: add missing check for rx wcid entries\\n\\nNon-station wcid entries must not be passed to the rx functions.\\nIn case of the global wcid entry, it could even lead to corruption in the wcid\\narray due to pointer being casted to struct mt7996_sta_link using container_of.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7464b12b7d92b9641d4664735b9f3c3f0b6173d9\",\"lessThan\":\"69dcc19048fcdc3fb166fd25b805470ee8fc0eb1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7464b12b7d92b9641d4664735b9f3c3f0b6173d9\",\"lessThan\":\"4a522b01e368eec58d182ecc47d24f49a39e440d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.6\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T17:43:14.308348Z\",\"id\":\"CVE-2025-39919\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.15\",\"versionEndExcluding\":\"6.16.6\",\"matchCriteriaId\":\"D4C2E438-04A8-4E8E-9CA1-54C86857F8B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4a522b01e368eec58d182ecc47d24f49a39e440d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69dcc19048fcdc3fb166fd25b805470ee8fc0eb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:21:44+00:00",
      "cve": "CVE-2025-39919",
      "id": "CVE-2025-39919",
      "initial_release_date": "2025-10-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: mt7996: add missing check for rx wcid entries",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39919.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-11T14:25:43Z",
      "cve": "CVE-2025-39919",
      "id": "CVE-2025-39919",
      "initial_release_date": "2025-10-01T23:22:51Z",
      "product_status:known_not_affected": "343",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39919",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39919.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39919\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T17:43:14.308348Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T17:43:10.161Z\"}}], \"cna\": {\"title\": \"wifi: mt76: mt7996: add missing check for rx wcid entries\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The bug is triggered purely by receiving an 802.11 frame in `mt7996_mac_fill_rx()`, so any attacker within radio range of an MT7996/MT7992/MT7990 AP can reach it. Per kernel scoring guidance, WiFi frame injection is Adjacent.\\nAC:L - The attacker simply transmits broadcast/multicast or unassociated-station frames, which the hardware maps to the reserved non-station wcid entry \\u2014 the exact case the removed `!wcid-\u003esta` check used to reject. Nothing about the trigger depends on conditions outside the attacker\u0027s control, and on a tri-band device the `phy_idx != band_idx` condition for the deepest wild-pointer path is satisfied just by picking the 5 GHz or 6 GHz radio.\\nPR:N - No association, authentication, or key negotiation is needed; frames from an entirely unknown device are precisely the ones that resolve to a non-station wcid. The RX path runs as soon as the interface is up (`MT76_STATE_RUNNING`).\\nUI:N - The corruption happens autonomously in the driver\u0027s NAPI/RX handling of an injected frame. No victim action is involved.\\nS:U - The corruption is confined to kernel memory of the same host under the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The bogus `container_of()` produces out-of-bounds reads of `msta_link-\u003esta`, `msta-\u003evif`, `mvif-\u003emt76.link[i]`, and `msta-\u003elink[i]`, all landing in or beyond the `dev-\u003ewcid[]` pointer array and leaking kernel pointers. Once `dev-\u003ewcid[3..6]` are overwritten, subsequent frames use attacker-influenced pointers as `struct mt76_wcid`, giving an arbitrary-read primitive.\\nI:H - `mt7996_mac_sta_poll()` writes 32+ bytes of hardware airtime-counter data through the mis-cast pointer directly over the `dev-\u003emt76.wcid[]` RCU pointer array, and the counter values are influenceable by the attacker\u0027s own traffic. Corrupted wcid pointers are then written through on later frames (`rx_key_pn` memcpy, rssi/stats updates, list operations), yielding a controllable write primitive suitable for control-flow hijack.\\nA:H - Dereferencing the wild pointers built from overwritten wcid array slots, plus list operations on garbage `poll_list`/`rc_list` heads, reliably oopses or panics the kernel. An attacker in radio range can repeat this at will, permanently downing the AP.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7464b12b7d92b9641d4664735b9f3c3f0b6173d9\", \"lessThan\": \"69dcc19048fcdc3fb166fd25b805470ee8fc0eb1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7464b12b7d92b9641d4664735b9f3c3f0b6173d9\", \"lessThan\": \"4a522b01e368eec58d182ecc47d24f49a39e440d\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.16.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/mediatek/mt76/mt7996/mac.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/69dcc19048fcdc3fb166fd25b805470ee8fc0eb1\"}, {\"url\": \"https://git.kernel.org/stable/c/4a522b01e368eec58d182ecc47d24f49a39e440d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7996: add missing check for rx wcid entries\\n\\nNon-station wcid entries must not be passed to the rx functions.\\nIn case of the global wcid entry, it could even lead to corruption in the wcid\\narray due to pointer being casted to struct mt7996_sta_link using container_of.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.6\", \"versionStartIncluding\": \"6.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"6.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:06:04.087Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39919\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:06:04.087Z\", \"dateReserved\": \"2025-04-16T07:20:57.147Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-10-01T07:55:14.804Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.