CVE-2025-39761 wifi: ath12k: Decrement TID on RX peer frag setup error handling
A missing decrement in the ath12k WiFi driver causes out-of-bounds access, potentially leading to crashes or data leaks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39761?
CVE-2025-39761 is a high-severity memory corruption vulnerability in Linux kernel, published on 11 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Decrement TID on RX peer frag setup error handling
Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to out-of-bounds access in peer->rx_tid[].
Hence, add a decrement operation for TID, before peer cleanup to ensures proper cleanup and prevents out-of-bounds access issues when the RX peer frag setup fails.
Found during code review. Compile tested only.
Weakness: CWE-125
Which versions are affected by CVE-2025-39761?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39761?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-39761 being exploited?
There is no known exploitation of CVE-2025-39761 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39761, DEBIAN-CVE-2025-39761, GHSA-55f8-prfx-mfvw, ROOT-OS-DEBIAN-11-CVE-2025-39761, ROOT-OS-DEBIAN-12-CVE-2025-39761, ROOT-OS-UBUNTU-2204-CVE-2025-39761 and 2 more.