GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-39761 (GCVE-0-2025-39761)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:52 – Updated: 2026-08-05 12:05
VLAI
Title
wifi: ath12k: Decrement TID on RX peer frag setup error handling
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to out-of-bounds access in peer->rx_tid[]. Hence, add a decrement operation for TID, before peer cleanup to ensures proper cleanup and prevents out-of-bounds access issues when the RX peer frag setup fails. Found during code review. Compile tested only.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 7c3e99fd4a66a5ac9c7dd32db07359666efe0002 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < a3b73c72c42348bf1555fd2b00f32f941324b242 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 9530d666f4376c294cdf4348c29fe3542fec980a (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 7c0884fcd2ddde0544d2e77f297ae461e1f53f58 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.43 , ≤ 6.12.* (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "7c3e99fd4a66a5ac9c7dd32db07359666efe0002",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "a3b73c72c42348bf1555fd2b00f32f941324b242",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "9530d666f4376c294cdf4348c29fe3542fec980a",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "7c0884fcd2ddde0544d2e77f297ae461e1f53f58",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Decrement TID on RX peer frag setup error handling\n\nCurrently, TID is not decremented before peer cleanup, during error\nhandling path of ath12k_dp_rx_peer_frag_setup(). This could lead to\nout-of-bounds access in peer-\u003erx_tid[].\n\nHence, add a decrement operation for TID, before peer cleanup to\nensures proper cleanup and prevents out-of-bounds access issues when\nthe RX peer frag setup fails.\n\nFound during code review. Compile tested only."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path is entered from `ath12k_mac_station_add()` when a WiFi peer is added, which in AP/mesh mode is driven by a station within radio range sending Authentication/peering frames. This requires adjacency on the 802.11 link, not routable network access.\nAC:L - The attacker drives both the trigger and the failure condition \u2014 repeated association/deauthentication floods create the peer-unmap race that makes `ath12k_dp_rx_peer_frag_setup()` return -ENOENT, and the same flood (17 DMA queue buffers plus a peer struct per station, up to 2048 peers) creates the memory pressure that fails `crypto_alloc_shash()`. Both sides of the race are attacker-controlled, and the attempt can be repeated indefinitely at no cost.\nPR:N - In AP and mesh mode the `NOTEXIST -\u003e NONE` sta_state transition occurs on receipt of an Authentication/peering frame, before the 4-way handshake verifies any credentials, so an unauthenticated station reaches `ath12k_dp_peer_setup()`. On open networks no credentials exist at all.\nUI:N - An attacking station associates with the ath12k AP on its own initiative; no action by any local user or administrator is needed.\nS:U - The out-of-bounds read, the `kfree()` of an OOB-derived pointer, and the REO LUT corruption all occur within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `ath12k_dp_rx_peer_tid_delete()` reads a full 128-byte `ath12k_dp_rx_tid` at `peer-\u003erx_tid[17]`, 72 bytes of which lie past the end of the 2312-byte allocation in un-zeroed kmalloc-4096 slack, and copies it into a REO command element. The read is unbounded stale-slab content, not a few bounded bytes, and the recovered pointer/DMA-address values feed further driver operations.\nI:H - The path performs an out-of-bounds write (`rx_tid-\u003eactive = false` clobbers `peer-\u003emcast_keyidx`, the index used to select the group decryption key at `mac.c:8144`), zeroes another peer\u0027s TID-0 entry in the hardware-shared REO LUT at index `peer_id*17 + 17` (or writes 8 bytes past the LUT at `DP_MAX_PEER_ID`), and reaches `kfree()` on a pointer read from groomable slab slack \u2014 an arbitrary-free primitive leveragable for heap corruption and control-flow hijack.\nA:H - `kfree()` of a garbage pointer and `dma_unmap_single()` with a bogus address and size cause slab-corruption panics and IOMMU faults, while zeroing another station\u0027s REO queue address in a table the WiFi hardware reads breaks that peer\u0027s RX path and can wedge the firmware, all triggerable repeatedly by an unauthenticated nearby station."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:01.054Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c3e99fd4a66a5ac9c7dd32db07359666efe0002"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3b73c72c42348bf1555fd2b00f32f941324b242"
        },
        {
          "url": "https://git.kernel.org/stable/c/9530d666f4376c294cdf4348c29fe3542fec980a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c0884fcd2ddde0544d2e77f297ae461e1f53f58"
        }
      ],
      "title": "wifi: ath12k: Decrement TID on RX peer frag setup error handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39761",
    "datePublished": "2025-09-11T16:52:29.788Z",
    "dateReserved": "2025-04-16T07:20:57.126Z",
    "dateUpdated": "2026-08-05T12:05:01.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39761",
      "date": "2026-09-16",
      "epss": "0.00233",
      "percentile": "0.1434"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:38:11.000Z",
      "cve": "CVE-2025-39761",
      "id": "msrc_CVE-2025-39761",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: ath12k: Decrement TID on RX peer frag setup error handling",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39761.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39761\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-11T17:15:40.153\",\"lastModified\":\"2026-07-30T06:23:44.203\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: Decrement TID on RX peer frag setup error handling\\n\\nCurrently, TID is not decremented before peer cleanup, during error\\nhandling path of ath12k_dp_rx_peer_frag_setup(). This could lead to\\nout-of-bounds access in peer-\u003erx_tid[].\\n\\nHence, add a decrement operation for TID, before peer cleanup to\\nensures proper cleanup and prevents out-of-bounds access issues when\\nthe RX peer frag setup fails.\\n\\nFound during code review. Compile tested only.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/dp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"7c3e99fd4a66a5ac9c7dd32db07359666efe0002\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"a3b73c72c42348bf1555fd2b00f32f941324b242\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"9530d666f4376c294cdf4348c29fe3542fec980a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"7c0884fcd2ddde0544d2e77f297ae461e1f53f58\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/dp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.103\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.43\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.11\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.2\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.103\",\"matchCriteriaId\":\"10BE5EF1-67C8-493D-A211-55E7C09E9092\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.43\",\"matchCriteriaId\":\"472C5F87-2BF3-4FAB-9B21-DA7513977363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.11\",\"matchCriteriaId\":\"BC242347-F722-43AE-B910-BE0B22386977\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.2\",\"matchCriteriaId\":\"BD7C087D-2415-4521-B624-30003352F899\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7c0884fcd2ddde0544d2e77f297ae461e1f53f58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c3e99fd4a66a5ac9c7dd32db07359666efe0002\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9530d666f4376c294cdf4348c29fe3542fec980a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a3b73c72c42348bf1555fd2b00f32f941324b242\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:57:52+00:00",
      "cve": "CVE-2025-39761",
      "id": "CVE-2025-39761",
      "initial_release_date": "2025-09-11T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39761.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-29T01:17:00Z",
      "cve": "CVE-2025-39761",
      "id": "CVE-2025-39761",
      "initial_release_date": "2025-09-11T23:24:08Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "387",
      "product_status:recommended": "507",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39761",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39761.json",
      "version": "50"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.