CVE-2025-39919

MEDIUM

Linux Kernel 6.15-6.16.5 - Memory Corruption via mt7996 WiFi Driver wcid Array Handling

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: add missing check for rx wcid entries Non-station wcid entries must not be passed to the rx functions. In case of the global wcid entry, it could even lead to corruption in the wcid array due to pointer being casted to struct mt7996_sta_link using container_of.

References (2)

Core 2

Core References

Patch

https://git.kernel.org/stable/c/69dcc19048fcdc3fb166fd25b805470ee8fc0eb1

Patch

https://git.kernel.org/stable/c/4a522b01e368eec58d182ecc47d24f49a39e440d

Scores

CVSS v3 5.5

EPSS 0.0012

EPSS Percentile 2.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (9)

linux/Kernel 6.15.0 - 6.16.6linux

Linux/Linux < 6.15

Linux/Linux 6.15

Linux/Linux 6.16.6 - 6.16.*

Linux/Linux 6.17

Linux/Linux 7464b12b7d92b9641d4664735b9f3c3f0b6173d9 - 4a522b01e368eec58d182ecc47d24f49a39e440d

Linux/Linux 7464b12b7d92b9641d4664735b9f3c3f0b6173d9 - 69dcc19048fcdc3fb166fd25b805470ee8fc0eb1

linux/linux_kernel 6.17 rc1 (4 CPE variants)

linux/linux_kernel 6.15 - 6.16.6

Published Oct 01, 2025

Tracked Since Feb 18, 2026